Alert creation channel
Create Alert
Creates a new alert, assuming the payload is valid.
If the alert already exists, CDC will treat this command with UPSERT semantics.
Accepts the following message:
Create a new alert in the CDC.
This message is a command message that will result in alert creation, assuming all required fields were specified.
The name of the source system from which this alert originated. Normally, the name of the SIEM.
The name of the alert
The identifier of the alert, as it appears in the source system. In most cases this would be the ID as it appears in the SIEM.
The description of the alert. It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
The severity of the alert. Must be one of the severities defined in CDC.
Timestamp of alert detection
The source URL of the alert in the SIEM or in the origin system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert raw data, as provided by the SIEM or source system.
Keys must not begin with . or $
Additional properties are allowed.
Alert tags
Items:
Additional items are allowed.
Mapping of alert to one of the use cases
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The observables associated with this alert
Items:
The type of the observable. Notice that an observable is uniquely identified by the combination of its type and value.
The value of the observable. Notice that an observable is uniquely identified by the combination of its type and value.
Tags associated with this observable. May be empty if an observable has no tags associated.
Items:
Additional items are allowed.
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Determines if the observable is an IOC. (false by default)
Additional properties are allowed.
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Additional properties are allowed.
Additional items are allowed.
Events property is deprecatd. Used for backwards compatibility, use observables property.
The observables associated with this alert
Items:
The type of the observable. Notice that an observable is uniquely identified by the combination of its type and value.
The value of the observable. Notice that an observable is uniquely identified by the combination of its type and value.
Tags associated with this observable. May be empty if an observable has no tags associated.
Items:
Additional items are allowed.
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Determines if the observable is an IOC. (false by default)
Additional properties are allowed.
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Additional properties are allowed.
Additional items are allowed.
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Classification category that the alert falls into.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Alert creation reply channel
Create Alert Reply
Result of a create alert command.
Accepts one of the following messages:
The reply which returned after creating an alert
This message is a reply for alert create
A unique, machine-oriented ID identifying this alert.
The name of the source system
The ID of the alert in the source system
The name of the alert
The description of the alert
The severity of the alert. Must be one of the severities defined in CDC.
Alert creation timestamp, in UTC
Last modification timestamp, in UTC
Alert detection timestamp, in UTC
Alert status
A URI of this alert pointing to the source system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert Use Case name
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
List of tags of alert observables
Items:
Additional items are allowed.
Classification for the alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert closure channel
Close Alert
Closes an alert.
Accepts the following message:
Closes an alert
This message is a command message that will result in alert closure
The unique Alert ID as defined by CDC
Details explaining why this alert was marked as irrelevant. Only appears if the alert was closed as irrelevant.
Alert closure reason Possible default values are: "Benign Positive", "True Positive", "False Positive - Incorrect alert logic", "False Positive - Inaccurate data" and "Undetermined"
Notice: There could be an additional possible custom reasons, but only if such exist at CDC (metamodels)
Analyst-provided comment for closing an alert
Note: property "comment" is required if the "reason" property is "Other"
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Alert closure reply channel
Close Alert Reply
Result of a close alert command.
Accepts one of the following messages:
Closes an alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert reopen channel
Reopen Alert
Reopens an alert.
Accepts the following message:
Reopens an alert
This message is a command message that will result in alert reopen
The unique Alert ID as defined by CDC
The reason why this alert was reopened, as provided by the analyst
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Alert reopen reply channel
Reopen Alert Reply
Result of a reopen alert command.
Accepts one of the following messages:
Reopens an alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert set detail channel
Set Alert Detail
Set alert detail.
Accepts the following message:
set alert detail
This message is a command message that will result in setting the specified detail in alert. By using this command it's possible to update the fields, which are only informational, they are not related to any flow or operation.
The unique Alert ID as defined by CDC
If specified, will set the name field of the alert
If specified, will set the description field of the alert.It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
If specified, will set the useCase field of the alert
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
The severity of the alert. Must be one of the severities defined in CDC.
Name of detection rule from SIEM that triggered the generation of alert
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Set Alert Detail reply channel
Set Alert Detail Reply
Result of a alert detail set command.
Accepts one of the following messages:
The reply which returned after alert detail set
This message is a reply for alert detail set
A unique, machine-oriented ID identifying this alert.
The name of the source system
The ID of the alert in the source system
The name of the alert
The description of the alert
The severity of the alert. Must be one of the severities defined in CDC.
Alert creation timestamp, in UTC
Last modification timestamp, in UTC
Alert detection timestamp, in UTC
Alert status
A URI of this alert pointing to the source system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert Use Case name
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
List of tags of alert observables
Items:
Additional items are allowed.
Classification for the alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert update classification channel
Update Alert Classification
Update alert classification.
Accepts the following message:
update alert classification
This message is a command message that will result updating the alert classification.
The unique Alert ID as defined by CDC
New value for the alert classification
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Update alert classification update reply channel
Update Alert Classification Reply
Result of a alert classification update command.
Accepts one of the following messages:
The reply which returned after alert classification updated
This message is a reply for alert classification update
A unique, machine-oriented ID identifying this alert.
The name of the source system
The ID of the alert in the source system
The name of the alert
The description of the alert
The severity of the alert. Must be one of the severities defined in CDC.
Alert creation timestamp, in UTC
Last modification timestamp, in UTC
Alert detection timestamp, in UTC
Alert status
A URI of this alert pointing to the source system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert Use Case name
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
List of tags of alert observables
Items:
Additional items are allowed.
Classification for the alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Composite Update Alert channel
Composite Update Alert
Composite Update Alert
Aggregates multiple update operations on alert:
For "Single" fields (e.g. company, descritption) - Will override the values.
For "Collection" fields (e.g. killChain, tags) - Will add new values.
name, description, severity, useCase, company, detectionRule.Accepts the following message:
Composite Update Alert
This message is a command message that will result in a multiple update operations on an Alert.
For "Single" fields (e.g. company, descritption) - Will override the values.
For "Collection" fields (e.g. killChain, tags) - Will add new values.
The unique Alert ID as defined by CDC
If specified, will set the name field of the alert
Update operation: setAlertDetails - The existing value will be overriden Shouldn't be null or empty
If specified, will set the description field of the alert
Update operation: setAlertDetails - The existing value will be overriden Shouldn't be null or empty It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
If specified, will set the useCase field of the alert
Update operation: setAlertDetails - The existing value will be overriden Can be null or empty - In such case will delete the existing value
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Update operation: setAlertDetails - The existing value will be overriden Can be null or empty - In such case will delete the existing value
Alert severity (could be also the custom value defined in settings)
Update operation: setAlertDetails - The existing value will be overriden Shouldn't be null or empty
Name of detection rule from SIEM that triggered the generation of alert
Update operation: setAlertDetails - The existing value will be overriden Can be null or empty - In such case will delete the existing value
The threat type with which this alert is associated.
Update operation: setAlertDetails - The existing value will be overriden Shouldn't be null or empty
The attacker, whoever launched the attack/campaign/malware.
Update operation: addThreatActors - New values will be added. Can be null or empty - In such case will ignore the field.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Update operation: addMalwareTools - New values will be added. Can be null or empty - In such case will ignore the field.
Items:
Additional items are allowed.
Instruction how to handle alert.
Update operation: setAlertDetails - The existing value will be overriden Can be null or empty - In such case will delete the existing value
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
Validations:
Update operation: addKillChain - New values will be added. Can be null or empty - In such case will ignore the field.
Items:
Additional items are allowed.
The tags to be added to the alert Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Update operation: addTags - New values will be added. Can be null or empty - In such case will ignore the field.
Items:
Additional items are allowed.
The MitreAttack Ids to be added to the Alert
Update operation: addMitreAttacks - New values will be added. Can be null or empty - In such case will ignore the field.
Items:
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Composite update alert reply channel
Composite update alert Reply
Result of a composite update alert command.
Accepts one of the following messages:
The reply which returned after Composite Update Alert operation
This message is a reply for Composite Update Alert operation
Composite Update Alert operations will fail only when ALL update operations failed. In this case a composite error will be sent. Note: A CompositeServerError will be received also for a single update operation. e.g. If there is only single field update (e.g. "description") that means there will be one only one update operations "setAlertDetails" so if this update will fail => 1 out of 1 operation failed => A CompositeServerError will be received holding this single error.
When only part of the update operations failed, the reply will containd the updated alert state and a list of errors describing the failure causes of the failed operstions.
The state of the alert after the update.
A unique, machine-oriented ID identifying this alert.
The name of the source system
The ID of the alert in the source system
The name of the alert
The description of the alert
The severity of the alert. Must be one of the severities defined in CDC.
Alert creation timestamp, in UTC
Last modification timestamp, in UTC
Alert detection timestamp, in UTC
Alert status
A URI of this alert pointing to the source system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert Use Case name
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
List of tags of alert observables
Items:
Additional items are allowed.
Classification for the alert
Additional properties are allowed.
List of errors
A message summarizing the cause of the error
Additional properties are allowed.
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if errors (single or multiple) occured while running an operation on the server.
This reply will hold a General error message and a list of errors that occured while running an operation.
Note: the errors array may be with only one item.
ServerError
ERR_SERVER
A general error message that summarize the failure of the operation.
List of errors
A message summarizing the cause of the error
Additional properties are allowed.
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert add observables channel
Add Observables to Alert
Adds observables to an alert.
Accepts the following message:
Adds observables to alert
This message is a command message that adds observables to an alert
The unique Alert ID as defined by CDC
The observables to be added to the alert
Items:
The type of the observable
The value of the observable
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Extra properties of the observable
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Related extra properties of the observable
Additional properties must adhere to the following schema:
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Items:
Additional items are allowed.
Additional properties are allowed.
Additional properties are allowed.
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding Observables to Alert reply channel
Add Observables to Alert Reply
Result of a add observables to alert command.
Accepts one of the following messages:
The reply which returned after adding observables to alert
This message is a reply for additing observables to alert
The unique Alert ID as defined by CDC
The list of all observables associated with the alert after the operation has completed
The type of the observable
The value of the observable
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert add tag channel
Add tags to Alert
Adds tags to an alert.
Accepts the following message:
Adds tags to alert
This message is a command message that adds tags to an alert
The unique Alert ID as defined by CDC
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding tags to Alert reply channel
Add tags to Alert Reply
Result of a add tags to alert command.
Accepts one of the following messages:
The reply which returned after tags added to alert
This message is a reply for add tags to alert
The unique Alert ID as defined by CDC
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add to Alert Kill Chain channel
Add to Alert Kill Chain
Add phases to alert Kill Chain. This operation is idempotent (upsert)
Accepts the following message:
Adds phases to alert Kill Chain
This message is a command message that adds phases to alert Kill Chain Mapping
The unique Alert ID as defined by CDC
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
Validations:
Items:
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Add to Alert Kill Chain reply channel
Add to Alert Kill Chain Reply
Result of a add to alert killChain command.
Accepts one of the following messages:
Updata Alert Kill Chain Reply
A unique, machine-oriented ID identifying this alert.
Last modification timestamp
The Id of the user responsible for last alert update.
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert append raw data channel
Append Alert Raw Data
Append data to alert raw data
externalId is passed it will ensure the data won't be duplicated. When two requests passed with the same externalId and the first request succeed, the second request will be ignored and the success response will be returned.Accepts the following message:
Append To Alert Raw Data
This message is a command message append raw data to an alert
The unique Alert ID as defined by CDC
Alert raw data, as provided by the SIEM or source system.
Notice Keys must not begin with . or * or $
Additional properties are allowed.
External identification for the raw data slices to ensure the same data won't be written twice.
When two requests passed with the same externalId and the first request succeed, the second request will be ignored and the success response will be returned.
When externalId is not passed it won't be guaranteed the data won't be duplicated.
NOTICE External Id must be unique (for alert scope) for the data appended.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Append Alert Raw Data reply channel
Append Alert Raw Data Reply
Result of a Append Alert Raw Data command.
Accepts one of the following messages:
The reply which returned after raw data appended to alert
This message is a reply for append alert raw data
The unique Alert ID as defined by CDC
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add mitre attacks to Alert
Add mitre attacks to Alert
Adds the specified mitre attacks to the specified alert.
Accepts the following message:
Adds the specified MitreAttacks to the specified alert
MitreAttack Ids List
Items:
Additional items are allowed.
The unique Alert ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding mitre attacks to alert reply channel
Add Mitre Attacks to Alert Reply
Result of a add mitre attacks to alert command.
Accepts one of the following messages:
The reply which returned after adding mitre attacks to alert
This message is a reply for additing mitre attacks to alert
The unique Alert ID as defined by CDC
MitreAttack Ids List
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Remove mitre attacks from Alert
Remove mitre attacks from Alert
Removes the specified mitre attacks from the specified alert.
Accepts the following message:
Removes the specified MitreAttacks from the specified alert
MitreAttack Ids List
Items:
Additional items are allowed.
The unique Alert ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Removing mitre attacks from alert reply channel
Remove Mitre Attacks from Alert Reply
Result of a remove mitre attacks from alert command.
Accepts one of the following messages:
The reply which returned after removing mitre attacks from alert
This message is a reply for removing mitre attacks from alert
The unique Alert ID as defined by CDC
MitreAttack Ids List
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert add evidence channel
Add evidence to Alert
Adds evidence to an alert.
Accepts the following message:
Adds evidence to alert
This message is a command message that adds evidence to an alert
Validations:
The unique Alert ID as defined by CDC
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
The time when this evidence was reported
The caption of the evidence
The ID of the message this evidence was created from.
The description of this evidence
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding evidence to Alert reply channel
Add evidence to Alert Reply
Result of a add evidence to alert command.
Accepts one of the following messages:
The reply which returned after evidence added to alert
This message is a reply for add evidence to alert
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident creation channel
Create Incident
Creates a new incident.
Accepts the following message:
Create a new incident in the CDC.
This message is a command message that will result in incident creation
The name of the incident
Incident description. It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
The incident priority must be one of the priorities defined in CDC.
Incident type. Must be one of the types defined in CDC.
The alert IDs to be added to the Incident
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
IDs of this incident as listed in external systems
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident creation reply channel
Create Incident Reply
Result of a create incident command.
Accepts one of the following messages:
The reply which returned after creating an incident
This message is a reply for incident create
A unique, machine-oriented ID identifying this incident
A unique, human-oriented key identifying this incident
The name of the incident
The incident description
The time when the incident was created, in UTC
The time when the incident was last updated, in UTC
Incident type
Incident status
The incident priority must be one of the priorities defined in CDC.
The group to which this incident is currently assigned
Array of external identifiers of the entity.
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
If this incident was redirected to a different group this will contain the name of the target group
If this incident was redirected to a different group this will contain the user comment provided with redirection request
Service level agreement end date
Additional properties are allowed.
The IDs of all alerts associated with the incident
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
IncidentValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add (Attach) Alerts to Incident
Add (Attach) Alerts to Incident
Adds the specified alerts to the specified incident.
Accepts the following message:
Adds the specified alerts to the specified incident
This message is a command message that adds alerts to an incident
The alert IDs to be added to the Incident
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
The unique Incident ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Add (Attach) Alerts to Incident reply channel
Add (Attach) Alerts to Incident Reply
Result of an add alerts to incident command.
Accepts one of the following messages:
The reply which returned after adding alerts to the incident
This message is a reply for adding alerts to the incident
The unique Incident ID as defined by CDC
The IDs of all alerts associated with the incident after the operation has completed
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Remove (Detach) Alerts from Incident
Remove (Detach) Alerts from Incident
Detaches the specified alerts from specified incident which alerts belongs to.
Accepts the following message:
Removes the specified alerts from the specified incident
This message is a command message that removes alerts from an incident
The alert IDs to be removed from the Incident
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
The unique Incident ID as defined by CDC
Flag that indicates if Alert Observables should be removed from the Incident
alert status after detaching
alert closing reason, required if nextStateOptions.status is Closed
alert closing reason (value should be one of pre-set in metamodels)
alert closing comment
Additional properties are allowed.
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Remove (Detach) Alerts from Incident reply channel
Remove (Detach) Alerts from Incident Reply
Result of a remove alerts from incident command.
Accepts one of the following messages:
The reply which returned after removing alerts from the incident
This message is a reply for removing alerts from the incident
The unique Incident ID as defined by CDC
The IDs of all alerts removed from the incident after the operation has completed
Items:
The unique Alert ID as defined by CDC
Additional items are allowed.
The IDs of all observables removed from the incident after the operation has completed
Items:
The unique Observable ID as defined by CDC
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add observables to incident
Add Observables to Incident
Adds the specified observables to the specified incident.
Accepts the following message:
Adds the specified observables to the specified incident
The observables to be added to the Incident
The observable's value
The observable's type
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Additional items are allowed.
The unique Incident ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding observables to incident reply channel
Add Observables to Incident Reply
Result of a add observables to incident command.
Accepts one of the following messages:
The reply which returned after adding observables to incident
This message is a reply for additing observables to incident
The unique Incident ID as defined by CDC
The list of all observables associated with the incident after the operation has completed
The type of the observable
The value of the observable
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add mitre attacks to Incident
Add mitre attacks to Incident
Adds the specified mitre attacks to the specified incident.
Accepts the following message:
Adds the specified MitreAttacks to the specified incident
MitreAttack Ids List
Items:
Additional items are allowed.
The unique Incident ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding mitre attacks to incident reply channel
Add Mitre Attacks to Incident Reply
Result of a add mitre attacks to incident command.
Accepts one of the following messages:
The reply which returned after adding mitre attacks to incident
This message is a reply for additing mitre attacks to incident
The unique Incident ID as defined by CDC
MitreAttack Ids List
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Remove mitre attacks from Incident
Remove mitre attacks from Incident
Removes the specified mitre attacks from the specified incident.
Accepts the following message:
Removes the specified MitreAttacks from the specified incident
MitreAttack Ids List
Items:
Additional items are allowed.
The unique Incident ID as defined by CDC
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Removing mitre attacks from incident reply channel
Remove Mitre Attacks from Incident Reply
Result of a remove mitre attacks from incident command.
Accepts one of the following messages:
The reply which returned after removing mitre attacks from incident
This message is a reply for removing mitre attacks from incident
The unique Incident ID as defined by CDC
MitreAttack Ids List
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident updates channel
Update Incident Details
Updates specified fields of the incident
Accepts the following message:
Updates specified incident fields
This message is a command message that will update the specified incident details
The unique Incident ID as defined by CDC
The name of the incident
Incident description. It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
The priority of this incident. Must be one of the priorities defined in CDC.
Incident type. Must be one of the types defined in CDC.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident updating reply channel
Update Incident Details Reply
Result of a update incident details command.
Accepts one of the following messages:
The reply which returned after updating the incident details
This message is a reply for incident details update
A unique, machine-oriented ID identifying this incident
A unique, human-oriented key identifying this incident
The name of the incident
The incident description
The time when the incident was created, in UTC
The time when the incident was last updated, in UTC
Incident type
Incident status
The incident priority must be one of the priorities defined in CDC.
The group to which this incident is currently assigned
Array of external identifiers of the entity.
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
If this incident was redirected to a different group this will contain the name of the target group
If this incident was redirected to a different group this will contain the user comment provided with redirection request
Service level agreement end date
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident closure channel
Close Incident
Closes an incident
Accepts the following message:
Closes an incident
This message is a command message that will result in incident closure
Incident ID to close
Incident closure summary
Incident closure reason Possible default values are: "Benign Positive", "True Positive", "False Positive - Incorrect alert logic", "False Positive - Inaccurate data" and "Undetermined"
Notice: There could be an additional possible custom reasons, but only if such exist at CDC (metamodels)
Terminate playbooks parameter
Possible values:
Incident closure tier group
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident closure reply channel
Close Incident Reply
Result of a close incident command.
Accepts one of the following messages:
Closes an incident
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ConflictError
ERR_CONFLICT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident redirection channel
Redirect Incident
Redirects an incident to a different group.
Accepts the following message:
Redirects an incident to another group
This message is a command message that will result in incident redirection
The unique Incident ID as defined by CDC
The group to which the incident is being redirected
The reason why this incident is being redirected
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident redirection reply channel
Redirect Incident Reply
Result of a incident redirect action.
Accepts one of the following messages:
The reply which returned after redirection of incident to another group
Additional properties are allowed.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ConflictError
ERR_CONFLICT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident external ID linking channel
Link External ID
Links an incident to an external ID
Accepts the following message:
Links an incident to an external ID
The unique Incident ID as defined by CDC
The external ID that will be linked to the incident
The name of the external system
The entity's identifier in the external system
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident external ID linking reply channel
Link External ID Reply
Result of a link external id to incident command.
Accepts one of the following messages:
The reply which returned after linking external id to the incident
This message is a reply for linking external id to the incident
A unique, machine-oriented ID identifying this incident
A unique, human-oriented key identifying this incident
The name of the incident
The incident description
The time when the incident was created, in UTC
The time when the incident was last updated, in UTC
Incident type
Incident status
The incident priority must be one of the priorities defined in CDC.
The group to which this incident is currently assigned
Array of external identifiers of the entity.
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
If this incident was redirected to a different group this will contain the name of the target group
If this incident was redirected to a different group this will contain the user comment provided with redirection request
Service level agreement end date
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident external ID unlinking channel
Unlink External ID
Unlinks an external ID from the incident
Accepts the following message:
Unlinks an incident from an external ID
The unique Incident ID as defined by CDC
The external ID that will be unlinked from the incident
The name of the external system
The entity's identifier in the external system
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident external ID unlinking reply channel
Unlink External ID Reply
Result of a unlink external id from incident command.
Accepts one of the following messages:
The reply which returned after unlinking external id from the incident
This message is a reply for unlinking external id from the incident
A unique, machine-oriented ID identifying this incident
A unique, human-oriented key identifying this incident
The name of the incident
The incident description
The time when the incident was created, in UTC
The time when the incident was last updated, in UTC
Incident type
Incident status
The incident priority must be one of the priorities defined in CDC.
The group to which this incident is currently assigned
Array of external identifiers of the entity.
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
If this incident was redirected to a different group this will contain the name of the target group
If this incident was redirected to a different group this will contain the user comment provided with redirection request
Service level agreement end date
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if incident with specified identifier does not exist
IncidentNotFoundError
ERR_NOT_FOUND
The incident ${incidentId} is not exist.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident add evidence channel
Add evidence to Incident
Adds evidence to an incident.
Accepts the following message:
Adds evidence to incident
This message is a command message that adds evidence to an incident
Validations:
The unique Incident ID as defined by CDC
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
The time when this evidence was reported
The caption of the evidence
The ID of the message this evidence was created from.
The description of this evidence
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Adding evidence to Incident reply channel
Add evidence to Incident Reply
Result of a add evidence to incident command.
Accepts one of the following messages:
The reply which returned after evidence added to incident
This message is a reply for add evidence to incident
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Add Enrichment to Observable channel
Add Enrichment to Observable
Adds new enrichment to the specified observable.
Accepts the following message:
Adds the enrichment to the specified observable
This message is a command message that adds enrichment to the observable
The unique Observable ID as defined by CDC
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Raw data of completed enrichment
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Add Enrichment to Observable reply channel
Add Enrichment to Observable Reply
Result of an add enrichment to observable command.
Accepts one of the following messages:
The reply which returned after adding enrichment to the observable
This message is a reply for adding adding enrichment to the observable
Enrichment status
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Enrichment expiration, in seconds.
Raw data of completed enrichment
Additional properties are allowed.
The time of when the enriched data was reported to the information provider
In case the enrichment failed, this field contains the error message
Enrichment creation timestamp
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Message creating channel
Create Chat Message
Create a message in CDC and post it to chat. The message can be posted in scope of alert, incident or channel.
Accepts the following message:
Creates a message to CDC chat
This message is a command message that will create a chat message in CDC
The identifier of the message, as it appears in external systems. Only one message can be linked to each unique externalId.
entities in the system can have a scope defining their assosication with a bussiness object
id of the entity as saved in the system
The type of the entity( alert / incident ...)
Additional properties are allowed.
Parent message ID, used for displaying replies in a threaded manner.
A list of file id's that should be attached to the message.
Files scope should match to the provided message scope.
e.g. if file is uploaded to alert:123 then it cannot be attached to message with scope alert:456 but only to messages with scope alert:123.
Trying to attach fileIds where some file scope does not match the message scope, will result in a ConflictError.
Items:
Additional items are allowed.
The content of the message
the text of the message. can be simple text or rich text
Message content type that has text representation
Additional properties are allowed.
the raw data attached for the porpuse of populating the card
Additional properties are allowed.
The Adaptive Card template name.
Message content type that represents an adaptiveCard
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
The user id of the user who initiated this action, as defined in CDC
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Message creating reply channel
Create Chat Message Reply
Result of a create message action.
Accepts one of the following messages:
The reply which returned after creating message to the chat
This message is a reply of successfull creating message to the chat
ID of the message as saved in the system
The identifier of the message, as it appears in external systems. Only one message can be linked to each unique externalId.
entities in the system can have a scope defining their assosication with a bussiness object
id of the entity as saved in the system
The type of the entity( alert / incident ...)
Additional properties are allowed.
If present, this message was posted in another message's thread
The content of the message
the text of the message. can be simple text or rich text
Message content type that has text representation
Additional properties are allowed.
the raw data attached for the porpuse of populating the card
Additional properties are allowed.
The Adaptive Card template name.
Message content type that represents an adaptiveCard
Additional properties are allowed.
An array of FileInfo objects, each holds the metadata of an attached file
The field is mandatory, an empty array will be returned when no files attached to the message.
The status of the file, respecting the upload and sanitaion process. Every file should have a status
uploaded - uploaded but not ready yet, requires additional processingprocessing - being processed by the system, i.e. pending sanitationverified - completed sanitation processes, needs to move to final storage locationready - completed and made availablefailed - the file upload process has failed, such as when sanitation can't be appliedblocked - the file sanitation process failed ( i.e. file has malicious content )A unique, machine-oriented ID identifying this file.
The file name
entities in the system can have a scope defining their assosication with a bussiness object
id of the entity as saved in the system
The type of the entity( alert / incident ...)
Additional properties are allowed.
The file url
The url of the file thumbnail. A thumbnail is a small image representation of a larger image or a video.
the file size in bytes
The MIME (Multipurpose Internet Mail Extensions) type of the file. A two-part identifier for file formats and format contents transmitted on the Internet. see more: https://en.wikipedia.org/wiki/Media_type
An identifier specified as a suffix to the name of a file
File creation timestamp
The ID of the user who created this file.
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ConflictError
ERR_CONFLICT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ForbiddenError
ERR_FORBIDDEN
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Alert extended properties channel
Add additional properties to the alert
Set additional properties for Alert.
Accepts the following message:
A definition for Alert extended properties set
The list of the Alert extended properties which need to be set
The internal field name which defined by CDC modeling for fields.
The value that fit to the entity type which defined in CDC settings For email it will be an email and for IP address it will be IP address.
Additional items are allowed.
The alert id
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Alert Extended Properties Set reply channel
Alert Extended Properties Set Reply
Result of a alert extended properties set.
Accepts one of the following messages:
The reply which is returned after the addition of alert extended properties
The list of fields that were added
field name
field value which can be of type string or date or number
Additional properties are allowed.
The unique mongo ID of the saved document
The mongo id of the user
The mongo id of the user
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
The reply which returned if there is concurrency issues during operation execution
ForbiddenError
ERR_FORBIDDEN
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ConflictError
ERR_CONFLICT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which is returned if an invalid argument was passed which caused the action to fail.
BadRequestError
ERR_BAD_REQUEST
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unhandled error occurred during action execution.
ApplicationError
ERR_APPLICATION
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Incident summary set channel
Add summary values for incident
Set summary overview fields for incident.
Accepts the following message:
A definition for Incident summary set
The list of the Incident summary answers which need to be set
The internal field name which defined by CDC modeling for fields.
The value that fit to the entity type which defined in CDC settings. By default HTML format is selected.
Additional items are allowed.
The incident id
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Incident Summary set reply channel
Incident Summary Set Reply
Result of a incident summary set.
Accepts one of the following messages:
The reply which is returned after the addition of incident summary fields
The list of fields that were added
field name
field value which can be of type string or date or number
Additional properties are allowed.
The unique mongo ID of the saved document
The mongo id of the user
The mongo id of the user
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
The reply which returned if there is concurrency issues during operation execution
ForbiddenError
ERR_FORBIDDEN
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if there is concurrency issues during operation execution
ConflictError
ERR_CONFLICT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which is returned if an invalid argument was passed which caused the action to fail.
BadRequestError
ERR_BAD_REQUEST
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unhandled error occurred during action execution.
ApplicationError
ERR_APPLICATION
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
AlertClosed events
Subscribes to all "AlertClosed" events. These events are fired once an alert changes status to "Closed" OR "Resolved" (when incident with alert was closed).
Accepts the following message:
An alert was closed
This event is fired when an alert is closed
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Alert status upon closure
Details explaining why this alert was marked as irrelevant. Only appears if the alert was closed as irrelevant.
Alert closure reason Possible default values are: "Benign Positive", "True Positive", "False Positive - Incorrect alert logic", "False Positive - Inaccurate data" and "Undetermined"
Notice: There could be an additional possible custom reasons, but only if such exist at CDC (metamodels)
Analyst-provided comment for closing an alert
Note: property "comment" is required if the "reason" property is "Other"
Additional properties are allowed.
Alert closure summary that consists of closingReason.reason and closingReason.comment.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertCreated events
Subscribes to all "AlertCreated" events. These events are fired once an alert is created.
Accepts the following message:
An alert was created
This event is fired when an alert is created in CDC
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Classification category that the alert falls into.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertUpdated events
Subscribes to all "AlertUpdated" events. These events are fired when an update operation was applied to an alert changing at least one of its fields.
Accepts the following message:
An alert was updated
This event is fired when at least one of the fields on an alert was changed due to an update operation.
The payload of this event holds the new state of the alert, after the update.
A unique, machine-oriented ID identifying this alert.
The name of the source system
The ID of the alert in the source system
The name of the alert
The description of the alert
The severity of the alert. Must be one of the severities defined in CDC.
Alert creation timestamp, in UTC
Last modification timestamp, in UTC
Alert detection timestamp, in UTC
Alert status
A URI of this alert pointing to the source system
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Alert Use Case name
Name of detection rule from SIEM that triggered the generation of alert
Mapping of alert to specific Kill Chain phases. The case of the names will be ignored, as well as spaces and duplicate values. All values will be normalized accroding to the provided enum. See in Wikipedia
This field accepts any value; the provided enum shows the recommended values.
Items:
Additional items are allowed.
MitreAttack Ids List
Items:
Additional items are allowed.
The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.
The threat type with which this alert is associated.
The attacker, whoever launched the attack/campaign/malware.
Items:
Additional items are allowed.
The Malware/Tools that were used in the attack.
Items:
Additional items are allowed.
The data source that was used for opening the alert.
Items:
Additional items are allowed.
Instruction how to handle alert.
Mapping of alert to specific category in SIEM
Items:
Additional items are allowed.
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
List of tags of alert observables
Items:
Additional items are allowed.
Classification for the alert
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertRateChanged events
Subscribes to all "AlertRateChanged" events. These events are fired when an alert's rate is changed.
Accepts the following message:
An alert's suspicious rate has changed
This event is fired when an alert's suspicious rate changes
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertReopened events
Subscribes to all "AlertReopened" events. These events are fired once an alert changes status from "Closed" or from "Resolved" (when incident with alert was reopened).
Accepts the following message:
An alert was reopened
This event is fired when an alert is reopened
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Alert status before reopen
The reason why this alert was reopened, as provided by the analyst
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertRawDataAppended events
Subscribes to all "AlertRawDataAppended" events. These events are fired when an raw data is appended to alert.
Accepts the following message:
Raw data appended to alert
This event is fired when a raw data appended to alert
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
Appended raw data id
Raw data external id. Can be used for idempotence and deduplication
Creation timestamp
Last modification timestamp
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertMessageAdded events
Subscribes to all "AlertMessageAdded" events. These events are fired once message added to alert".
Accepts the following message:
A message added to alert
This event is fired when a message added to alert in CDC
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Alert messageId
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertOwnerChanged events
Subscribes to all "AlertOwnerChanged" events. These events are fired once alert owner changed".
Accepts the following message:
An alert was changed owner
This event is fired when an alert is changed owner in CDC
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Alert owner assignee Id
This field is Nullable.
Null value meaning: The owner was removed from an alert.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertCompanyChanged events
Subscribes to all "AlertCompanyChanged" events.
These events are fired when an alert's company has changed.
Accepts the following message:
An alert's company has changed
This event is fired when an alert's company changes
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Alert status
The new (current) name of the company / division to which this alert belongs.
This field is Nullable.
Null value meaning: The company was removed from alert.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertObservableAdded events
Subscribes to all "AlertObservableAdded" events, which are fired whenever an observable is added to an alert
Accepts the following message:
Observables were added to the alert
This event is fired when observables are added to an alert. If multiple observables are added in a single API call, then a single event will be fired
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
The list of observables that were added to the alert
The type of the observable
The value of the observable
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertTagsAdded events
Subscribes to all "AlertTagsAdded" events, which are fired whenever tags are added to an alert
Accepts the following message:
Tags were added to the alert
This event is fired when tags are added to an alert. If multiple tags are added in a single API call, then a single event will be fired
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
The list of tags that were added to the alert
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertDetailChanged events
Subscribes to all "AlertDetailChanged" events.
These events are fired when an alert's detail has changed.
Accepts the following message:
An alert's detail has changed
This event is fired when an alert's detail changes.
The possible fields are: name, description, severity, useCase, company, detectionRule
which are only informational, they are not related to any flow or operation
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
The previous alert name
The new (current) alert name
Additional properties are allowed.
The previous alert description
The new (current) alert description
Additional properties are allowed.
The previous name of the company / division to which this alert belongs.
This field is Nullable.
Null value meaning: The company was not attached or removed from alert.
The new (current) name of the company / division to which this alert belongs.
This field is Nullable.
Null value meaning: The company was removed from alert.
Additional properties are allowed.
The previous alert severity
The new (current) alert severity
Additional properties are allowed.
The previous alert useCase
The new (current) alert useCase
Additional properties are allowed.
The previous alert detectionRule
The new (current) alert detectionRule
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertEvidenceAdded events
Subscribes to all "AlertEvidenceAdded" events. These events are fired when an evidence is added to an alert.
Accepts the following message:
Evidence was added to or removed from the alert
This event is fired when an evidence is added to an alert.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertEvidenceRemoved events
Subscribes to all "AlertEvidenceRemoved" events. These events are fired when an evidence is removed from an alert.
Accepts the following message:
Evidence was added to or removed from the alert
This event is fired when an evidence is removed from an alert.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The URL of the alert, as defined in the source system. Note: not all alerts include this field
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertAddedToIncident events
Subscribes to all "AlertAddedToIncident" events. These events are fired when an alert is added (attached) to an incident. For the opposite event, see the "AlertRemovedFromIncident" event.
Accepts the following message:
An alert was added to an incident
This event is fired when an alert is added to an incident.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
AlertRemovedFromIncident events
Subscribes to all "AlertRemovedFromIncident" events. These events are fired when an alert is removed (detached) from an incident. For the opposite event, see the "AlertAddedToIncident" event.
Accepts the following message:
An alert was removed from an incident
This event is fired when an alert is removed from an incident.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Alert ID as defined by CDC
The identifier of the source system from which this alert originated. Usually this is the name of the SIEM, but in some cases the alert may originate from some other kind of system, like an IT tickets management system.
The ID of the alert, as defined in the source system. The combination of source + sourceId is guaranteed to be unique (a composite identifier)
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentAssociatedWithCompany events
Subscribes to all "IncidentAssociatedWithCompany" events. These events are fired when an incident is associated with a company: both on initial association and on association changes. Note that most tenants do not use the "company" feature.
Accepts the following message:
An incident was associated with a company
This event is fired when an incident is associated with a company (both upon initial association, and upon changes to the association)
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The previous name of the company / division to which this alert belongs.
This field is Nullable.
Null value meaning: The company was not attached or removed from alert. examples: [CompanyName, null]
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentClosed events
Subscribes to all "IncidentClosed" events. These events are fired when an incident is closed. Note that an incident may be closed, then reopened, then closed again - in such case a second "Incident Closed" event will be fired.
Accepts the following message:
An incident was closed
This event is fired when an incident is closed
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The name of the incident
Incident closure summary and survey
Incident closure summary
Incident closure reason Possible default values are: "Benign Positive", "True Positive", "False Positive - Incorrect alert logic", "False Positive - Inaccurate data" and "Undetermined"
Notice: There could be an additional possible custom reasons, but only if such exist at CDC (metamodels)
Incident closure survey, which includes system-defined questions and the answers provided by the SoC analyst. In case the incident is closed via the external API or by SeeMo, no survey will be included.
Survey question text
Survey answer as provided by the SoC analyst
Additional items are allowed.
the identifier of user who closed an incident
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentCreated events
Subscribes to all "IncidentCreated" events. These events are fired when a new incident is created.
Accepts the following message:
A new incident was created
This event is fired when an incident is created
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The name of the incident
Incident description. It cannot exceed 5000 characters, when exceeds the command will not fail but description will be truncated.
Incident priority
Incident status
Name of the company / division to which this incident or alert belongs.
Not to be confused with the "organization" field, which was used to distinguish between tenants and is deprecated.
Note that most customer don't use the "company" feature. Note the value must be in the list of companies defined in CDC database
The incident owner.
This field is Nullable.
Null value meaning: The incident was created by BOT.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The name of the group (tier) to which this incident is assigned
Incident type
Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified. When used as query filters, tags are treated as case-insensitive.
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentDescriptionChanged events
Subscribes to all "IncidentDescriptionChanged" events
Accepts the following message:
Incident description has changed
This event is fired when the description of the incident is changed
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The previous incident description
The new (current) incident description
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentEvidenceAdded events
Subscribes to all "IncidentEvidenceAdded" events. These events are fired when an evidence is added to an incident.
Accepts the following message:
Evidence was added to or removed from the incident
This event is fired when an evidence is added to an incident.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentEvidenceRemoved events
Subscribes to all "IncidentEvidenceRemoved" events. These events are fired when an evidence is removed from an incident.
Accepts the following message:
Evidence was added to or removed from the incident
This event is fired when an evidence is removed from an incident.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
Validations:
A unique, machine-oriented ID identifying this evidence.
The caption of the evidence
name property is deprecated. Used for backwards compatibility, instead use caption property.
The evidence description. Note that this field may contain HTML tags.
The type of evidence
The unique Alert ID as defined by CDC
The name of the alert
The unique Incident ID as defined by CDC
The name of the incident
The name of the rule on which alert was attached to the incident using grouping rules mechanism
Items:
to check if the value matches with alert field
Additional items are allowed.
alert field name for grouping mechanism
compare fieldName with matchValue by this operator
Additional items are allowed.
Additional properties are allowed.
Timestamp of when the evidence was created
Timestamp of when the evidence was reported (could be different than the evidence creation timestamp)
The ID of the message this evidence was created from
The URL of the message in the CDC application that this evidence was created from.
guiUrl property is deprecated. Used for backwards compatibility, instead use messageCdcUrl property.
The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentNameChanged events
Subscribes to all "IncidentNameChanged" events
Accepts the following message:
Incident name has changed
This event is fired when the name of the incident is changed
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The previous incident name
The new (current) incident name
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentObservableAdded events
Subscribes to all "IncidentObservableAdded" events, which are fired whenever an observable is added to an incident
Accepts the following message:
Observables were added to the incident
This event is fired when observables are added to an incident. If multiple observables are added or removed in a single API call, then a single event will be fired
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The type of the observable
The value of the observable
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentObservableRemoved events
Subscribes to all "IncidentObservableRemoved" events, which are fired whenever an observable is removed from an incident
Accepts the following message:
Observables were removed from the incident
This event is fired when observables are removed from an incident. If multiple observables are removed in a single API call, then a single event will be fired
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The type of the observable
The value of the observable
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentPriorityChanged events
Subscribes to all "IncidentPriorityChanged" events, which are fired whenever an incident's priority is changed
Accepts the following message:
Incident priority has changed
This event is fired when the priority of the incident is changed
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The previous incident priority
The new incident priority
Alert's id that triggered incident priority change
Reason for priority change
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentRedirectionAccepted events
Subscribes to all "IncidentRedirectionAccepted" events, which are fired whenever an incident redirection is accepted by the target group
Accepts the following message:
Incident redirection request has been accepted
This event is fired when an incident redirection request is accepted by the target group. Note that an incident may be redirected several times during its lifetime.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
The name of the incident
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The user who owned this incident prior to the redirection
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The group to which the incident was assigned before the redirection (source group)
Incident status
Additional properties are allowed.
The user who owns this incident after the redirection
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The group to which the incident was redirected (target group / destination group)
Incident status
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentRedirectionInitiated events
Subscribes to all "IncidentRedirectionInitiated" events, which are fired whenever an incident redirection is initiated
Accepts the following message:
Incident redirection request has been initiated
This event is fired when an incident redirection request is issued. Note that an incident may be redirected several times during its lifetime.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The name of the incident
The group to which the incident was assigned before the redirection
The group to which the incident is being redirected
The reason for redirecting this incident
Incident status
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentRedirectionRevoked events
Subscribes to all "IncidentRedirectionRevoked" events, which are fired whenever an incident redirection request is revoked.
Note that revocation occurs in all following scenarios:
Accepts the following message:
Incident redirection request has been revoked
This event is fired when an incident redirection request is revoked.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The name of the incident
The group to which the incident is assigned
The group to which the incident was being redirected
Incident status
Analyst-provided reason for revoking the redirection request
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentReopened events
Subscribes to all "IncidentReopened" events, which are fired whenever a closed incident is being reopened
Accepts the following message:
Incident reopened
This event is fired when an incident that was closed has been reopened.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
The name of the incident
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The reason why this incident was reopened, as provided by the analyst
The user who owns currently owns this incident (after it was reopened)
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The group to which the incident is currently assigned (after it was reopened)
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
IncidentTagsChanged events
Subscribes to all "IncidentTagsChanged" events, which are fired whenever tags are added or removed from an incident
Accepts the following message:
Incident tags changed
This event is fired when tags are added or removed from an incident
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The unique Incident ID as defined by CDC
incident unique key
Incident's external identifiers
The name of the external system
The entity's identifier in the external system
Additional items are allowed.
The incident tags prior to the change
Items:
Additional items are allowed.
The incident tags after the change
Items:
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
ObservableEnriched events
Subscribes to all "ObservableEnriched" events, which are fired whenever an observable has been enriched. Note that the same observable may be enriched multiple times, in which case multiple such events will be fired
Accepts the following message:
An observable has been enriched
This event is fired when an observable has been enriched with additional data from external infromation providers. Notice that the same observable may be enriched multiple times.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
The type of the observable.
The value of the observable.
Enrichment status
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Enrichment expiration, in seconds.
Raw data of completed enrichment
Additional properties are allowed.
The time of when the enriched data was reported to the information provider
In case the enrichment failed, this field contains the error message
Enrichment creation timestamp
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
ObservableRateChanged events
Subscribes to all "ObservableRateChanged" events, which are fired whenever an observable's suspicious rate is changed.
Accepts the following message:
An observable's rate has changed
This event is fired when an observable's suspicious rate has changed.
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
The type of the observable.
The value of the observable.
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
The suspicious rate of the observable (higher is more suspicious), between 0 and 100.
This field is Nullable.
Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
GroupingSettingsUpdated events
Subscribes to all "GroupingSettingsUpdated" events. These events are fired when grouping settings are updated in cdc settings.
Accepts the following message:
Grouping Settings were updated
This event is fired when Grouping Settings were updated
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
time limit in milliseconds. Time within which alerts could be grouped to an incident since it was created.
maximum number of alerts which can be attached to one incident.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
GroupingRulesRewritten events
Subscribes to all "GroupingRulesRewritten" events. These events are fired when grouping rules are rewritten in cdc settings.
Accepts the following message:
Grouping Rules were rewritten
This event is fired when Grouping Rules were rewritten
A unique identifier of this event. Can be used for idempotence and deduplication.
The time when this event occured, in UTC
Details about the user which initiated this event or operation. May be empty if the operation was not initiated by a user.
the user id as defined in CDC
User display name
User email address
The group this user is a member of
Additional properties are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Subscribes to user replied events
Subscribes too all UserActionRepliedEvent events. These are fired when a user completes a manual step in a playbook.
Accepts the following message:
Manual step has been marked as completed
This event is fired when a playbook step has been completed by the user.
Object with properties
Additional properties are allowed.
A unique identifier of for this step. Used to get corresponding user action on uca side.
Step's related playbook source
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Command invocation channel
Invoke automation command
Starts automation command
Accepts the following message:
Invoke the command for the automation engine.
This message invokes a command run for the automation engine
Command pack name
Action from the command pack
Details about the command invocation context
Entity type that the command was initiated for
CDC ID for the entity initiating the command invocation
CDC ID for the message that requested the command invocation
ID of the user who requested the command invocation
Additional properties are allowed.
Object with properties specific to the invoked command and its action.
Additional properties are allowed.
Additional properties are allowed.
Unique identifier of the operation, used for deduplication in case of reruns.
Reply address to which the reply message will be sent, in the following format: <exchangeName>:<routingKey>.
If not specified, no reply will be sent.
Action identifier, used for tracing and for matching replies to requests.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Command invocation reply channel
Invoke automation command reply
Result of a command invocation.
Accepts one of the following messages:
The reply which returned after the automation command completes
This message is a reply for invoke automation command
Command invocation error if it has occurred
Adaptive card type to display the proper command result
Object with Properties specific for the dataType to display the proper command result
Additional properties are allowed.
File attachments related to the command invocation response
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
Unique identifier of the operation, used for deduplication in case of reruns.
The reply which returned if any of the input data is not valid.
ValidationError
ERR_INVALID_INPUT
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if some entity does not exist.
NotFoundError
ERR_NOT_FOUND
The Error Message
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
The reply which returned if unexpected error occurred during action execution.
ServerError
ERR_SERVER
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
Action identifier, used for tracing and for matching replies to requests.
CommandsList events
Subscribes to all "CommandsList" events, which trigger whenever the commands list changes for the Automation Engine
Accepts the following message:
Command list changes for the Automation Engine
This event is fired when the command list changes for the Automation Engine. The event payload contains the full updated command list
The comaplete list of commands thatare available in ST2 engine
Command pack name
Action from the command pack
Short description for the command
Object with properties specific to the invoked command and its action. | Property names may vary, but each property implements the provided interface
Additional properties are allowed.
Additional items are allowed.
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
WorkflowCreated events by a service
Subscribes to all "WorkflowCreated" events. These events are fired once workflow is created.
Accepts the following message:
A workflow was created
This event is fired when an workflow is created
The workflow name
The workflow execution id
The unique workflow ID as defined by the service
The type of issuer of the workflow that was created
The identifier of the source system from which this workflow originated. Usually this is the name of the Service
The application name of the created workflow
valid iso date string representation
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
UserActionCreated events by a service
Subscribes to all "UserActionCreated" events. These events are fired once a user action is waiting for user response.
Accepts the following message:
A user action step was sent
This event is fired when a workflow run contains a user action step that requires user response
The action's execution Id
Additional properties are allowed.
The unique workflow ID as defined by the service
The type of issuer of the workflow that was created
The step status
Action name
The workflow name
The workflow execution id
valid iso date string representation
ID of the user who sent the event
A unique identifier of for this step. Used to get corresponding user action on uca side.
The identifier of the source system from which this workflow originated. Usually this is the name of the Service
Additional properties are allowed.
Schema and schema version, described in mime-type like format, e.g. {event-type}/{schema-name}; version={version}({-stage});
The schema name is always only dash-separated and in lowercase. The schema part is separated from version by semicolon symbol ";"
Usually only major part of version is important, so in most cases the version will be integer.
A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the major version.
{
message: {
payload: {
properties: {
- ruleDefaultTimeLimit: {
- type: "number"
- description: "default rule time limitation."
- example: 86400000
- }
}
}
}
}