Cisco XDR Feed API

openapi: 3.2.0
info:
  title: CTIA Feed API
  version: 4178275a824512c2fd3a2acdb0e8277233919054 v2.71.0
  license:
    name: All Rights Reserved
    url: ''
  contact:
    name: 'Cisco Security Business Group -- Advanced Threat '
    url: http://github.com/threatgrid/ctia
    email: cisco-intel-api-support@cisco.com
  description: "A Threat Intelligence API service\n\n  This API provides a mechanism for making Judgements on the Disposition\n  of Observables, which are then distilled into a final Verdict.  A\n  Disposition is a statement regarding the malicious, or otherwise,\n  nature of an Observable.\n\n  The Judgements can be grouped into Indicators, which can be associated\n  with Campaigns, Actors and TTPs.  Feedback can be given on specific\n  Judgements, indicating agreement or disagreement, or clarification.\n\n  When an Observable with a malicious Verdict is seen, it can be recorded as\n  a Sighting, and the Relations that Observable had with other Observables can\n  be recorded as well.\n\n  We support a pre-defined set of Observable Types.  Each Observable Type has a\n  specific form of natural identifier, its ID, which is almost always\n  the default way it is represented when observed in the wild.\n\n  * Ipv4/IPv6  -- 192.168.1.1\n  * Domain/Hostname -- foo.com, www.bar.com\n  * SHA256  -- the sha256 checksum of a file, or other data blob\n  * MD5 -- the md5 checksum of a file, or other data blob\n  * SHA1 -- the sha1 checksum of a file, or other data blob\n  * URL -- A minimal form of the URL\n\n  The Verdict is derived from all of the Judgements on that Observable which\n  have not yet expired.  The highest priority Judgement becomes the\n  active verdict.  If there is more than one Judgement with that\n  priority, than Clean disposition has priority over all others, then\n  Malicious disposition, and so on down to Unknown.\n\n  <a href='/doc/README.md'>CTIA Documentation</a>"
  x-provenance:
    method: harvested
    authored_by: Cisco XDR (CTIA)
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://private.intel.amp.cisco.com/index.html
  - type: raw
    url: https://private.intel.amp.cisco.com/swagger.json
servers:
- url: /
security:
- JWT: []
- oauth2:
  - private-intel
  - private-intel:read
  - private-intel:write
  - casebook
  - casebook:read
  - casebook:write
tags:
- name: Feed
  description: Feed operations
paths:
  /ctia/feed/{id}/view.txt:
    get:
      tags:
      - Feed
      summary: Get a Feed View as newline separated entries
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: s
        description: The feed share token
        required: true
        schema:
          type: string
      - in: query
        name: limit
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      responses:
        '200':
          description: ''
          content:
            text/plain:
              schema:
                type: string
        '404':
          description: ''
          content:
            text/plain:
              schema:
                type: string
        '401':
          description: ''
          content:
            text/plain:
              schema:
                type: string
  /ctia/feed/{id}/view:
    get:
      tags:
      - Feed
      summary: Get a Feed View
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: s
        description: The feed share token
        required: true
        schema:
          type: string
      - in: query
        name: limit
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FeedView'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/FeedView'
            application/edn:
              schema:
                $ref: '#/components/schemas/FeedView'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/FeedView'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/FeedView'
  /ctia/feed:
    post:
      tags:
      - Feed
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Feed'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Feed'
            application/edn:
              schema:
                $ref: '#/components/schemas/Feed'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Feed'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Feed'
      parameters:
      - in: query
        name: wait_for
        description: wait for entity to be available for search
        required: false
        schema:
          type: boolean
      summary: Adds a new Feed
      description: Requires capability create-feed.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/edn:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/NewFeed'
        description: a new Feed
        required: true
  /ctia/feed/{id}:
    put:
      tags:
      - Feed
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Feed'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/Feed'
            application/edn:
              schema:
                $ref: '#/components/schemas/Feed'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/Feed'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/Feed'
      parameters:
      - in: query
        name: wait_for
        description: wait for updated entity to be available for search
        required: false
        schema:
          type: boolean
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      summary: Updates a Feed
      description: Requires capability create-feed.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/edn:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/NewFeed'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/NewFeed'
        description: an updated Feed
        required: true
    get:
      tags:
      - Feed
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PartialFeed'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/PartialFeed'
            application/edn:
              schema:
                $ref: '#/components/schemas/PartialFeed'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/PartialFeed'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/PartialFeed'
      summary: Gets a Feed by ID
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - indicator_id
            - output
            - language
            - id
            - tlp
            - timestamp
      description: Requires capability read-feed.
    delete:
      tags:
      - Feed
      responses:
        '204':
          description: ''
      x-no-doc: false
      parameters:
      - in: path
        name: id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: wait_for
        description: wait for deleted entity to no more be available for search
        required: false
        schema:
          type: boolean
      summary: Deletes a Feed
      description: Requires capability delete-feed.
  /ctia/feed/external_id/{external_id}:
    get:
      tags:
      - Feed
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/x-yaml:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/edn:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/transit+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/transit+msgpack:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
      parameters:
      - in: query
        name: sort_order
        description: Sort direction
        required: false
        schema:
          type: string
          enum:
          - desc
          - asc
      - in: query
        name: offset
        description: Pagination Offset
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: limit
        description: Pagination Limit
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - indicator_id
            - output
            - language
            - id
            - tlp
            - timestamp
      - in: query
        name: sort_by
        description: ''
        required: false
        schema:
          type: string
          enum:
          - schema_version
          - revision
          - indicator_id
          - output
          - language
          - id
          - tlp
          - timestamp
      - in: path
        name: external_id
        description: ''
        required: true
        schema:
          type: string
      summary: List Feeds by external_id
      description: Requires capability read-feed.
  /ctia/feed/search:
    get:
      tags:
      - Feed
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/x-yaml:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/edn:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/transit+json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
            application/transit+msgpack:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PartialFeed'
      summary: Search for a Feed using a Lucene/ES query string
      parameters:
      - in: query
        name: sort_order
        description: Sort direction
        required: false
        schema:
          type: string
          enum:
          - desc
          - asc
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: sort_by
        description: ''
        required: false
        schema:
          type: string
          enum:
          - schema_version
          - revision
          - indicator_id
          - output
          - language
          - id
          - tlp
          - timestamp
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - indicator_id
            - output
            - language
            - id
            - tlp
            - timestamp
      - in: query
        name: search_after
        description: Pagination stateless cursor
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: limit
        description: Pagination Limit
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: offset
        description: Pagination Offset
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: simple_query
        description: Query String with simple query format
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      description: Requires capability search-feed.
    delete:
      tags:
      - Feed
      description: Requires capabilities delete-feed, search-feed.
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: integer
                format: int64
            application/x-yaml:
              schema:
                type: integer
                format: int64
            application/edn:
              schema:
                type: integer
                format: int64
            application/transit+json:
              schema:
                type: integer
                format: int64
            application/transit+msgpack:
              schema:
                type: integer
                format: int64
      summary: Delete Feed entities matching given Lucene/ES query string or/and field filters
      parameters:
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - indicator_id
            - output
            - language
            - id
            - tlp
            - timestamp
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: REALLY_DELETE_ALL_THESE_ENTITIES
        description: ' If you do not set this value or set it to false this route will perform a dry run. Set this value to true to perform the deletion. You MUST confirm you will fix the mess after the inevitable disaster that will occur after you perform that operation. DO NOT FORGET TO SET THAT TO FALSE AFTER EACH DELETION IF YOU INTEND TO USE THAT ROUTE MULTIPLE TIMES.'
        required: false
        schema:
          type: boolean
      - in: query
        name: wait_for
        description: wait for matched entity to be deleted
        required: false
        schema:
          type: boolean
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
  /ctia/feed/search/count:
    get:
      tags:
      - Feed
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: integer
                format: int64
            application/x-yaml:
              schema:
                type: integer
                format: int64
            application/edn:
              schema:
                type: integer
                format: int64
            application/transit+json:
              schema:
                type: integer
                format: int64
            application/transit+msgpack:
              schema:
                type: integer
                format: int64
      summary: Count Feed entities matching given search filters.
      parameters:
      - in: query
        name: from
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: to
        description: ''
        required: false
        schema:
          type: string
          format: date-time
      - in: query
        name: id
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: revision
        description: ''
        required: false
        schema:
          type: integer
          format: int64
      - in: query
        name: language
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: tlp
        description: ''
        required: false
        schema:
          type: string
      - in: query
        name: fields
        description: ''
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - schema_version
            - revision
            - indicator_id
            - output
            - language
            - id
            - tlp
            - timestamp
      - in: query
        name: query
        description: ''
        required: false
        schema:
          type: string
      description: Requires capability search-feed.
components:
  schemas:
    FeedView:
      type: object
      properties:
        judgements:
          type: array
          items:
            $ref: '#/components/schemas/Judgement'
        observables:
          type: array
          items:
            $ref: '#/components/schemas/Observable'
      additionalProperties: false
    ValidTime:
      example:
        start_time: '2016-01-01T01:01:01.000Z'
        end_time: '2016-01-01T01:01:01.000Z'
      description: Period of time when a cyber observation is valid.
      type: object
      properties:
        start_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If not present, the valid time position of the indicator does not have an upper bound.
          type: string
          format: date-time
        end_time:
          example: '2016-01-01T01:01:01.000Z'
          description: If end_time is not present, then the valid time position of the object does not have an upper bound.
          type: string
          format: date-time
      additionalProperties: false
    ExternalReference:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: false
      required:
      - source_name
    Observable:
      example:
        value: 1.2.3.4
        type: ip
      description: An AssetMapping is a record that a specific Observable maps to an Asset for an indicated period of time.
      type: object
      properties:
        value:
          example: 1.2.3.4
          description: The value of the observable.
          type: string
        type:
          example: ip
          description: The type of observable.
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      additionalProperties: false
      required:
      - value
      - type
    Judgement:
      example:
        valid_time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        schema_version: 1.3.30
        revision: 10
        observable:
          value: 1.2.3.4
          type: ip
        reason_uri: string
        type: judgement
        source: string
        external_ids:
        - string
        disposition: 1
        external_references:
        - source_name: string
          description: string
          url: string
          hashes:
          - string
          external_id: string
        reason: string
        source_uri: string
        disposition_name: Clean
        priority: 10
        language: string
        id: string
        severity: Critical
        tlp: green
        timestamp: '2016-01-01T01:01:01.000Z'
        confidence: High
      description: "A judgement about the intent or nature of an observable.  For\n  example, is it malicious, meaning is is malware and subverts system\n  operations?  It could also be clean and be from a known benign, or\n  trusted source.  It could also be common, something so widespread\n  that it's not likely to be malicious.\n\n  Since a core goal of the CTIA is to provide a simple verdict service,\n  these judgements are the basis for the returned verdicts.  These are\n  also the primary means by which users of the CTIA go from\n  observables on their system, to the indicators and threat\n  intelligence data in CTIA."
      type: object
      properties:
        valid_time:
          $ref: '#/components/schemas/ValidTime'
        schema_version:
          type: string
        revision:
          example: 10
          description: A monotonically increasing revision, incremented each time the object is changed.
          type: integer
          format: int64
        observable:
          $ref: '#/components/schemas/Observable'
        reason_uri:
          example: string
          description: A URI
          type: string
        type:
          example: judgement
          type: string
          enum:
          - judgement
        source:
          example: string
          description: Represents the source of the intelligence that led to the creation of the entity.
          type: string
        external_ids:
          example:
          - string
          description: "It is used to store a list of external identifiers that can be linked to the incident, providing a reliable and manageable way to correlate and group related events across multiple data sources. It is especially useful in larger organizations that rely on multiple security information and event management (SIEM) systems to detect security incidents. For instance, it can be used to track events across different network sensors, intrusion detection and prevention systems (IDPS), or log management platforms. \n The field can also be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. It can be used to cross-reference with other external tools such as threat intelligence feeds and vulnerability scanners."
          type: array
          items:
            type: string
        disposition:
          example: 1
          description: Matches :disposition_name as in {1 "Clean", 2 "Malicious", 3 "Suspicious", 4 "Common", 5 "Unknown"}
          type: integer
          format: int64
          enum:
          - 1
          - 4
          - 3
          - 2
          - 5
        external_references:
          example:
          - source_name: string
            description: string
            url: string
            hashes:
            - string
            external_id: string
          description: "Specifies a list of external references which refers to non-CTIM information.\n\nSimilar to `external_ids` field with major differences:\n\n- `external_ids` field is used to store a list of external identifiers that can be used to link entities across different data sources. These identifiers are typically standardized and well-known, such as CVE IDs, US-CERT advisories, or other industry-standard threat intelligence feeds. The `external_ids` field can be used to facilitate automation and orchestration workflows, where additional information can be shared among incident management systems. \n\n- `external_references` field, on the other hand, is used to provide a more general mechanism for linking entities to external sources of information. The `external_references` field can include references to blog posts, articles, external documents, threat intelligence reports, and other sources of information that may not have a standardized format or identifier."
          type: array
          items:
            $ref: '#/components/schemas/ExternalReference'
        reason:
          example: string
          description: String with at most 1024 characters.
          type: string
        source_uri:
          example: string
          description: URI of the source of the intelligence that led to the creation of the entity.
          type: string
        disposition_name:
          example: Clean
          description: String verdict identifiers.
          type: string
          enum:
          - Common
          - Unknown
          - Suspicious
          - Malicious
          - Clean
        priority:
          example: 10
          description: A value 0-100 that determine the priority of a judgement. Curated feeds of black/white lists, for example known good products within your organizations, should use a 95. All automated systems should use a priority of 90, or less.  Human judgements should have a priority of 100, so that humans can always override machines.
          type: integer
          format: int64
        language:
          example: string
          description: 'The `language` field is used to specify the primary language of the affected system or the target of an attack. It can be used to provide additional context and information about the entity. The primary purpose of this field is to help analysts filter and prioritize entities based on their knowledge and expertise of different languages.


            For example, if an incident involves an attack on a system in a country where a specific language is predominant, the `language` field can be used to indicate that language, which can help analysts to quickly identify and respond to incidents that may be geographically or culturally relevant. This information can be used to prioritize incidents ba

# --- truncated at 32 KB (54 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-feed-api-openapi.yml