OpenAPI Specification
openapi: 3.2.0
info:
title: Cisco Xdr Event API
version: '1.0'
description: 'Operations tagged Event across 2 of this provider''s published API definitions: cisco-xdr-ctia-openapi.json,
cisco-xdr-iroh-event-openapi.json. Each path carries the servers of the definition it was published in.'
x-provenance:
method: harvested
authored_by: Cisco XDR (CTIA)
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
derived_view: Per-tag view of cisco-xdr-ctia-openapi.json, the provider's source document. Operations and schemas are
the provider's, unmodified; only the partition is ours.
derived_from: cisco-xdr-ctia-openapi.json
operation_coverage: 6/9
x-evidence:
- type: source
url: https://private.intel.amp.cisco.com/index.html
- type: raw
url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: /
- url: https://visibility.amp.cisco.com/
tags:
- name: Event
description: Events operations
paths:
/ctia/event/history/{entity_id}:
get:
tags:
- Event
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/EventBucket'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/EventBucket'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/EventBucket'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/EventBucket'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/EventBucket'
parameters:
- in: path
name: entity_id
description: ''
required: true
schema:
type: string
summary: Timeline history of an entity
description: Requires capability search-event.
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
servers:
- url: /
/ctia/event/search:
get:
tags:
- Event
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
summary: Search for Event entities using a ES query syntax and field filters
description: Requires capability search-event.
parameters:
- in: query
name: sort_order
description: Sort direction
required: false
schema:
type: string
enum:
- desc
- asc
- in: query
name: tlp
description: ''
required: false
schema:
type: string
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: sort_by
description: 'Sort result on fields.
The following fields are supported: id, language, revision, schema_version, source, source_uri, timestamp, title,
tlp
Fields can be combined with '','' and sort order can be specified by '':asc'' and '':desc''. For example:
- id # sort by id ascending
- id:desc # sort by id descending
- id,language:desc # sort by id ascending, then language descending'
required: false
schema:
type: string
- in: query
name: fields
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
type: string
enum:
- id
- event_type
- groups
- timestamp
- entity.type
- owner
- entity.id
- in: query
name: search_after
description: Pagination stateless cursor
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: limit
description: Pagination Limit
required: false
schema:
type: integer
format: int64
- in: query
name: offset
description: Pagination Offset
required: false
schema:
type: integer
format: int64
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- in: query
name: revision
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
delete:
tags:
- Event
description: Requires capabilities delete-event, developer, search-event.
responses:
'200':
description: ''
content:
application/json:
schema:
type: integer
format: int64
application/x-yaml:
schema:
type: integer
format: int64
application/edn:
schema:
type: integer
format: int64
application/transit+json:
schema:
type: integer
format: int64
application/transit+msgpack:
schema:
type: integer
format: int64
summary: Delete Event entities matching given Lucene/ES query string or/and field filters
parameters:
- in: query
name: tlp
description: ''
required: false
schema:
type: string
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: search_after
description: Pagination stateless cursor
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: REALLY_DELETE_ALL_THESE_ENTITIES
description: ' If you do not set this value or set it to false this route will perform a dry run. Set this value to
true to perform the deletion. You MUST confirm you will fix the mess after the inevitable disaster that will occur
after you perform that operation. DO NOT FORGET TO SET THAT TO FALSE AFTER EACH DELETION IF YOU INTEND TO USE THAT
ROUTE MULTIPLE TIMES.'
required: false
schema:
type: boolean
- in: query
name: wait_for
description: wait for matched entity to be deleted
required: false
schema:
type: boolean
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- in: query
name: revision
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
servers:
- url: /
/ctia/event/search/count:
get:
tags:
- Event
responses:
'200':
description: ''
content:
application/json:
schema:
type: integer
format: int64
application/x-yaml:
schema:
type: integer
format: int64
application/edn:
schema:
type: integer
format: int64
application/transit+json:
schema:
type: integer
format: int64
application/transit+msgpack:
schema:
type: integer
format: int64
summary: Count Event matching a Lucene/ES query string and field filters
description: Requires capability search-event.
parameters:
- in: query
name: tlp
description: ''
required: false
schema:
type: string
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: search_after
description: Pagination stateless cursor
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: simple_query
description: Query String with simple query format
required: false
schema:
type: string
- in: query
name: revision
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
servers:
- url: /
/ctia/event/{id}:
get:
tags:
- Event
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/PartialEvent'
application/x-yaml:
schema:
$ref: '#/components/schemas/PartialEvent'
application/edn:
schema:
$ref: '#/components/schemas/PartialEvent'
application/transit+json:
schema:
$ref: '#/components/schemas/PartialEvent'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/PartialEvent'
summary: Get one Event by ID
parameters:
- in: path
name: id
description: ''
required: true
schema:
type: string
- in: query
name: fields
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
type: string
enum:
- id
- event_type
- groups
- timestamp
- entity.type
- owner
- entity.id
description: Requires capability read-event.
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
delete:
tags:
- Event
responses:
'204':
description: ''
x-no-doc: false
parameters:
- in: path
name: id
description: ''
required: true
schema:
type: string
- in: query
name: wait_for
description: wait for deleted entity to no more be available for search
required: false
schema:
type: boolean
summary: Delete one Event
description: Requires capabilities delete-event, developer.
security:
- JWT: []
- oauth2:
- private-intel
- private-intel:read
- private-intel:write
- casebook
- casebook:read
- casebook:write
servers:
- url: /
/iroh/iroh-event/event/{id}:
get:
x-no-doc: false
tags:
- Event
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Event'
application/x-yaml:
schema:
$ref: '#/components/schemas/Event'
application/edn:
schema:
$ref: '#/components/schemas/Event'
application/transit+json:
schema:
$ref: '#/components/schemas/Event'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Event'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `event:read`
'
parameters:
- in: path
name: id
description: ''
required: true
schema:
type: string
summary: Get an `Event`
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
servers:
- url: https://visibility.amp.cisco.com/
/iroh/iroh-event/event/search:
post:
x-no-doc: false
tags:
- Event
summary: Search for Events
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `event:read`
'
parameters:
- in: query
name: offset
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: limit
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: search_after
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
x-oneOf:
- type: string
- type: number
format: double
- type: string
- in: query
name: sort_by
description: ''
required: false
x-oneOf:
- type: string
- type: number
format: double
- type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- desc
- asc
- in: query
name: fields
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/SearchEventsResult'
application/x-yaml:
schema:
$ref: '#/components/schemas/SearchEventsResult'
application/edn:
schema:
$ref: '#/components/schemas/SearchEventsResult'
application/transit+json:
schema:
$ref: '#/components/schemas/SearchEventsResult'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/SearchEventsResult'
requestBody:
content:
application/json:
schema:
description: Filter on event data
x-oneOf:
- $ref: '#/components/schemas/GenericSearch'
- type: array
items:
type: string
enum:
- or
- not
- and
application/x-yaml:
schema:
description: Filter on event data
x-oneOf:
- $ref: '#/components/schemas/GenericSearch'
- type: array
items:
type: string
enum:
- or
- not
- and
application/edn:
schema:
description: Filter on event data
x-oneOf:
- $ref: '#/components/schemas/GenericSearch'
- type: array
items:
type: string
enum:
- or
- not
- and
application/transit+json:
schema:
description: Filter on event data
x-oneOf:
- $ref: '#/components/schemas/GenericSearch'
- type: array
items:
type: string
enum:
- or
- not
- and
application/transit+msgpack:
schema:
description: Filter on event data
x-oneOf:
- $ref: '#/components/schemas/GenericSearch'
- type: array
items:
type: string
enum:
- or
- not
- and
description: Filter on event data
required: true
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
servers:
- url: https://visibility.amp.cisco.com/
/iroh/iroh-event/event/incident/{incident-id}:
get:
x-no-doc: false
tags:
- Event
summary: Combines events from Private Intel and IROH using the IROH event format
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `event:read`
'
parameters:
- in: path
name: incident-id
description: ''
required: true
schema:
type: string
- in: query
name: offset
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: limit
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: search_after
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
x-oneOf:
- type: string
- type: number
format: double
- type: string
- in: query
name: sort_by
description: ''
required: false
x-oneOf:
- type: string
- type: number
format: double
- type: string
- in: query
name: sort_order
description: ''
required: false
schema:
type: string
enum:
- desc
- asc
- in: query
name: fields
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: include
description: ''
required: false
style: form
explode: true
schema:
type: array
items:
type: string
enum:
- response_actions
- incident_changes
- notes
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/Event'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/Event'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/Event'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/Event'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/Event'
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
servers:
- url: https://visibility.amp.cisco.com/
components:
schemas:
PartialEvent:
type: object
properties:
fields:
type: array
items:
$ref: '#/components/schemas/Update'
type:
type: string
enum:
- event
id:
type: string
tlp:
example: green
type: string
enum:
- white
- green
- red
- amber
event_type:
type: string
enum:
- record-created
- record-deleted
- record-updated
groups:
type: array
items:
type: string
timestamp:
type: string
format: date-time
entity:
$ref: '#/components/schemas/Response116834EventsEntity'
owner:
type: string
additionalProperties: false
Update:
type: object
properties:
field:
type: string
action:
type: string
enum:
- added
- deleted
- modified
change:
$ref: '#/components/schemas/Response116834EventsFieldsChange'
additionalProperties: false
required:
- field
- action
- change
Response116834EventsFieldsChange:
type: object
properties:
before: {}
after: {}
additionalProperties: false
Response116834EventsEntity:
type: object
additionalProperties: {}
EventBucket:
type: object
properties:
count:
type: integer
format: int64
from:
type: string
format: date-time
to:
type: string
format: date-time
owner:
type: string
events:
type: array
items:
$ref: '#/components/schemas/PartialEvent'
additionalProperties: false
required:
- count
- from
- to
- owner
- events
UpdatedField:
type: object
properties:
field:
type: string
action:
type: string
enum:
- added
- deleted
- modified
value:
$ref: '#/components/schemas/EventDataUpdatedFieldsValue'
additionalProperties: false
required:
- field
- action
- value
EntitlementData:
type: object
properties:
event_type:
type: string
enum:
- entitlements/updated
org_id:
type: string
additionalProperties: false
required:
- event_type
- org_id
SCIMInfos:
type: object
properties:
id:
type: string
access-token:
type: string
group-id:
type: string
additionalProperties: {}
required:
- id
- access-token
- group-id
EventEmiter:
type: object
properties:
user_id:
type: string
org_id:
type: string
client_id:
type: string
additionalProperties: false
required:
- user_id
- org_id
ModuleInstanceEventData:
type: object
properties:
event_type:
type: string
enum:
- module-instance/restricted
- module-instance/reactivated
- module-instance/updated
- module-instance/created
- module-instance/deleted
module_instance_id:
type: string
module_type_id:
type: string
module_instance_visibility:
type: string
enum:
- global
- org
- user
state_changed?:
type: boolean
additionalProperties: false
required:
- event_type
- module_instance_id
- module_type_id
- module_instance_visibility
UserEventData:
type: object
properties:
user_id:
type: string
new_user:
$ref: '#/components/schemas/User'
old_user:
$ref: '#/components/schemas/User'
event_type:
type: string
enum:
- user/updated
- user/deleted
- user/created
additionalProperties: false
required:
- user_id
- new_user
- old_user
- event_type
EventDataRelatedEntities:
type: object
properties:
entity_type:
type: string
entity_id:
type: string
additionalProperties: false
required:
- entity_type
- entity_id
NotificationRequestEventData:
type: object
properties:
event_type:
type: string
enum:
- notification-request/created
notification_request_id:
type: string
additionalProperties: false
required:
- event_type
- notification_request_id
Event:
type: object
properties:
created_at:
type: string
format: date-time
data:
x-oneOf:
- $ref: '#/components/schemas/ModuleInstanceEventData'
- $ref: '#/components/schemas/HighImpactIncidentEventData'
- $ref: '#/components/schemas/IncidentEnrichmentEventData'
- $ref: '#/components/schemas/IncidentStatusChangeEventData'
- $ref: '#/components/schemas/IncidentLastActivityChangeEventData'
- $ref: '#/components/schemas/PrivateIntelNoteEventData'
- $ref: '#/components/schemas/PrivateIntelIncidentData'
- $ref: '#/components/schemas/PIAMEntitlementData'
- $ref: '#/components/schemas/EntitlementData'
- $ref: '#/components/schemas/AutomationData'
- $ref: '#/components/schemas/NotificationRequestEventData'
- $ref: '#/components/schemas/OrgData'
- $ref: '#/components/schemas/PIAMProvisioningEventData'
- $ref: '#/components/schemas/UserEventData'
issuer:
type: string
id:
type: string
acknowledged_at:
type: string
format: date-time
emiter:
$ref: '#/components/schemas/EventEmiter'
sign:
$ref: '#/components/schemas/EventSign'
additionalProperties: false
required:
- data
- id
- emiter
EventDataAdditionalNoteRelatedEntities:
example:
entity_type: string
entity_id: string
type: object
properties:
entity_type:
example: string
type: string
entity_id:
example: string
description: A URI leading to an entity.
type: string
additionalProperties: {}
required:
- entity_type
- entity_id
EventDataAdditional:
type: object
properties:
note:
$ref: '#/components/schemas/EventDataAdditionalNote'
additionalProperties: false
required:
- note
EventDataUpdatedFieldsValue:
type: object
properties:
before: {}
after: {}
additionalProperties: false
EventDataAdditionalNoteExternalReferences:
example:
source_name: string
description: string
url: string
hashes:
- string
external_id: string
description: External references are used to describe pointers to information represented outside of CTIM. For example,
a Malware object could use an external reference to indicate an ID for that malware in an external database or a report
could use references to represent source material.
type: object
properties:
source_name:
example: string
description: The source within which the external-reference is defined (system, registry, organization, etc.)
type: string
description:
example: string
description: Markdown string with at most 5000 characters.
type: string
url:
example: string
description: A URL reference to an external resource.
type: string
hashes:
example:
- string
description: Specifies a dictionary of hashes for the contents of the url.
type: array
items:
type: string
external_id:
example: string
description: An identifier for the external reference content.
type: string
additionalPropert
# --- truncated at 32 KB (70 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-event-api-openapi.yml