openapi: 3.2.0
info:
title: PrivateIntel Service Private Intel API
version: 1.0.107
license:
name: All Rights Reserved
url: https://www.cisco.com
contact:
name: Cisco Security Business Group -- Advanced Threat
email: cisco-intel-api-support@cisco.com
description: A proxy to private-intel CTIA with various IROH hooks
x-provenance:
method: harvested
authored_by: Cisco XDR
harvested_by: API Evangelist
harvested_on: '2026-08-19'
first_party: true
note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
provider_published: true
x-evidence:
- type: source
url: https://visibility.amp.cisco.com/iroh/private-intel/index.html
- type: raw
url: https://visibility.amp.cisco.com/iroh/private-intel/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
- telemetry
- integration
- private-intel
- admin
- cognitive
- profile
- inspect
- asset
- event
- feedback
- sse
- registry
- users
- investigation
- invite
- casebook
- orbital
- enrich
- oauth
- vault
- response
- notification
- global-intel:read
- webhook
- ao
tags:
- name: Private Intel
description: Access private-intel
paths:
/iroh/private-intel/incident/search:
get:
x-no-doc: false
tags:
- Private Intel
summary: Search incidents in Private Intel. Incidents enriched with `:enrichment_status` when available.
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSearchResults'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSearchResults'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSearchResults'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSearchResults'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSearchResults'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident:read`
'
parameters:
- in: query
name: sort_order
description: 'Sort direction. Known values: asc, desc'
required: false
schema:
type: string
- in: query
name: categories
description: ''
required: false
schema:
type: string
- in: query
name: intended_effect
description: ''
required: false
schema:
type: string
- in: query
name: tlp
description: ''
required: false
schema:
type: string
- in: query
name: status
description: ''
required: false
schema:
type: string
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: promotion_method
description: ''
required: false
schema:
type: string
- in: query
name: sort_by
description: 'Sort results on a field. See /ctia/incident/search Swagger on private intel for all supported values. Known values: id, schema_version, revision, timestamp, language, tlp, source, source_uri, title, title, source, source_uri, confidence, status, incident_time.opened, incident_time.discovered, incident_time.reported, incident_time.remediated, incident_time.closed, incident_time.rejected, discovery_method, intended_effect, assignees, promotion_method'
required: false
schema:
type: string
- in: query
name: high_impact
description: ''
required: false
schema:
type: string
enum:
- 'false'
- 'true'
- in: query
name: fields
description: 'A list of fields. Known fields: id, schema_version, revision, timestamp, language, tlp, source, source_uri, title, title, source, source_uri, confidence, status, incident_time.opened, incident_time.discovered, incident_time.reported, incident_time.remediated, incident_time.closed, incident_time.rejected, discovery_method, intended_effect, assignees, promotion_method'
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: search_after
description: Pagination stateless cursor
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: assignees
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: limit
description: Pagination Limit
required: false
schema:
type: integer
format: int64
- in: query
name: offset
description: Pagination Offset
required: false
schema:
type: integer
format: int64
- in: query
name: confidence
description: ''
required: false
schema:
type: string
- in: query
name: discovery_method
description: ''
required: false
schema:
type: string
- in: query
name: source
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: revision
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
/iroh/private-intel/incident/{incident-id}/tactic/{mitre-id}:
get:
x-no-doc: false
tags:
- Private Intel
summary: Get MITRE tactic related to incident.
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/TacticView'
application/x-yaml:
schema:
$ref: '#/components/schemas/TacticView'
application/edn:
schema:
$ref: '#/components/schemas/TacticView'
application/transit+json:
schema:
$ref: '#/components/schemas/TacticView'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/TacticView'
parameters:
- in: path
name: incident-id
description: The identifier of the incident to retrieve.
required: true
schema:
type: string
- in: path
name: mitre-id
description: The identifier of the MITRE attack pattern to retrieve.
required: true
schema:
type: string
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `global-intel:read,private-intel/incident:read`
'
/iroh/private-intel/incident/{incident-id}/tactics:
get:
x-no-doc: false
tags:
- Private Intel
summary: Get all MITRE tactics related to incident.
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
parameters:
- in: path
name: incident-id
description: The identifier of the incident to retrieve.
required: true
schema:
type: string
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `global-intel:read,private-intel/incident:read`
'
/iroh/private-intel/incident/{incident-id}:
get:
x-no-doc: false
tags:
- Private Intel
summary: Get incident in Private Intel. Enriched with `:enrichment_status` when available.
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentWithEnrichmentStatus'
application/x-yaml:
schema:
$ref: '#/components/schemas/IncidentWithEnrichmentStatus'
application/edn:
schema:
$ref: '#/components/schemas/IncidentWithEnrichmentStatus'
application/transit+json:
schema:
$ref: '#/components/schemas/IncidentWithEnrichmentStatus'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/IncidentWithEnrichmentStatus'
parameters:
- in: path
name: incident-id
description: The identifier of the incident to retrieve.
required: true
schema:
type: string
- in: query
name: fields
description: 'A list of fields. Known fields: id, schema_version, revision, timestamp, language, tlp, source, source_uri, title, title, source, source_uri, confidence, status, incident_time.opened, incident_time.discovered, incident_time.reported, incident_time.remediated, incident_time.closed, incident_time.rejected, discovery_method, intended_effect, assignees, promotion_method'
required: false
style: form
explode: true
schema:
type: array
items:
type: string
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident:read`
'
patch:
x-no-doc: false
tags:
- Private Intel
summary: Patch an incident in Private Intel
parameters:
- in: query
name: wait_for
description: wait for updated entity to be available for search
required: false
schema:
type: boolean
- in: path
name: incident-id
description: The identifier of the incident to patch.
required: true
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Incident'
application/x-yaml:
schema:
$ref: '#/components/schemas/Incident'
application/edn:
schema:
$ref: '#/components/schemas/Incident'
application/transit+json:
schema:
$ref: '#/components/schemas/Incident'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Incident'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident`
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PatchIncident'
application/x-yaml:
schema:
$ref: '#/components/schemas/PatchIncident'
application/edn:
schema:
$ref: '#/components/schemas/PatchIncident'
application/transit+json:
schema:
$ref: '#/components/schemas/PatchIncident'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/PatchIncident'
description: For submitting a new Incident.
required: true
/iroh/private-intel/incident/{incident-id}/status:
post:
x-no-doc: false
tags:
- Private Intel
summary: Post an incident status to Private Intel
parameters:
- in: query
name: wait_for
description: wait for updated entity to be available for search
required: false
schema:
type: boolean
- in: path
name: incident-id
description: The identifier of the incident to retrieve.
required: true
schema:
type: string
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Incident'
application/x-yaml:
schema:
$ref: '#/components/schemas/Incident'
application/edn:
schema:
$ref: '#/components/schemas/Incident'
application/transit+json:
schema:
$ref: '#/components/schemas/Incident'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Incident'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident:write`
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/IncidentStatusUpdate'
application/x-yaml:
schema:
$ref: '#/components/schemas/IncidentStatusUpdate'
application/edn:
schema:
$ref: '#/components/schemas/IncidentStatusUpdate'
application/transit+json:
schema:
$ref: '#/components/schemas/IncidentStatusUpdate'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/IncidentStatusUpdate'
required: true
/iroh/private-intel/incident:
post:
x-no-doc: false
tags:
- Private Intel
summary: Post an incident to Private Intel
parameters:
- in: query
name: wait_for
description: wait for updated entity to be available for search
required: false
schema:
type: boolean
responses:
'201':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Incident'
application/x-yaml:
schema:
$ref: '#/components/schemas/Incident'
application/edn:
schema:
$ref: '#/components/schemas/Incident'
application/transit+json:
schema:
$ref: '#/components/schemas/Incident'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Incident'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident:write`
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/NewIncident'
application/x-yaml:
schema:
$ref: '#/components/schemas/NewIncident'
application/edn:
schema:
$ref: '#/components/schemas/NewIncident'
application/transit+json:
schema:
$ref: '#/components/schemas/NewIncident'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/NewIncident'
description: For submitting a new Incident.
required: true
/iroh/private-intel/incident-summary/search:
get:
x-no-doc: false
tags:
- Private Intel
summary: Search incident summaries in Private Intel for related entity data
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSummarySearchResults'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSummarySearchResults'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSummarySearchResults'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSummarySearchResults'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/IncidentSummarySearchResults'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/incident:read`
'
parameters:
- in: query
name: sort_order
description: 'Sort direction. Known values: asc, desc'
required: false
schema:
type: string
- in: query
name: categories
description: ''
required: false
schema:
type: string
- in: query
name: intended_effect
description: ''
required: false
schema:
type: string
- in: query
name: tlp
description: ''
required: false
schema:
type: string
- in: query
name: status
description: ''
required: false
schema:
type: string
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: promotion_method
description: ''
required: false
schema:
type: string
- in: query
name: sort_by
description: 'Sort results on a field. See /ctia/incident/search Swagger on private intel for all supported values. Known values: id, schema_version, revision, timestamp, language, tlp, source, source_uri, title, title, source, source_uri, confidence, status, incident_time.opened, incident_time.discovered, incident_time.reported, incident_time.remediated, incident_time.closed, incident_time.rejected, discovery_method, intended_effect, assignees, promotion_method'
required: false
schema:
type: string
- in: query
name: high_impact
description: ''
required: false
schema:
type: string
enum:
- 'false'
- 'true'
- in: query
name: fields
description: 'A list of fields. Known fields: id, schema_version, revision, timestamp, language, tlp, source, source_uri, title, title, source, source_uri, confidence, status, incident_time.opened, incident_time.discovered, incident_time.reported, incident_time.remediated, incident_time.closed, incident_time.rejected, discovery_method, intended_effect, assignees, promotion_method, context.assets, context.asset-mappings, context.asset-properties, context.incidents, context.indicators, context.malwares, context.sightings'
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: search_after
description: Pagination stateless cursor
required: false
style: form
explode: true
schema:
type: array
items:
type: string
- in: query
name: language
description: ''
required: false
schema:
type: string
- in: query
name: assignees
description: ''
required: false
schema:
type: string
- in: query
name: id
description: ''
required: false
schema:
type: string
- in: query
name: limit
description: Pagination Limit
required: false
schema:
type: integer
format: int64
- in: query
name: offset
description: Pagination Offset
required: false
schema:
type: integer
format: int64
- in: query
name: confidence
description: ''
required: false
schema:
type: string
- in: query
name: discovery_method
description: ''
required: false
schema:
type: string
- in: query
name: source
description: ''
required: false
schema:
type: string
- in: query
name: query
description: ''
required: false
schema:
type: string
- in: query
name: revision
description: ''
required: false
schema:
type: integer
format: int64
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
/iroh/private-intel/note:
post:
x-no-doc: false
tags:
- Private Intel
summary: Post a Note to Private Intel
parameters:
- in: query
name: wait_for
description: wait for updated entity to be available for search
required: false
schema:
type: boolean
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/Note'
application/x-yaml:
schema:
$ref: '#/components/schemas/Note'
application/edn:
schema:
$ref: '#/components/schemas/Note'
application/transit+json:
schema:
$ref: '#/components/schemas/Note'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/Note'
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel/note:write`
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/NewNote'
application/x-yaml:
schema:
$ref: '#/components/schemas/NewNote'
application/edn:
schema:
$ref: '#/components/schemas/NewNote'
application/transit+json:
schema:
$ref: '#/components/schemas/NewNote'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/NewNote'
description: Schema for submitting Notes
required: true
/iroh/private-intel/bundle/import:
post:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel:write`
'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BundleImportResult'
application/x-yaml:
schema:
$ref: '#/components/schemas/BundleImportResult'
application/edn:
schema:
$ref: '#/components/schemas/BundleImportResult'
application/transit+json:
schema:
$ref: '#/components/schemas/BundleImportResult'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/BundleImportResult'
summary: POST many new entities using a single HTTP call
parameters:
- in: query
name: external-key-prefixes
description: Comma separated list of external key prefixes
required: false
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/BundleImportBundle'
application/x-yaml:
schema:
$ref: '#/components/schemas/BundleImportBundle'
application/edn:
schema:
$ref: '#/components/schemas/BundleImportBundle'
application/transit+json:
schema:
$ref: '#/components/schemas/BundleImportBundle'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/BundleImportBundle'
description: a Bundle to import
required: true
/iroh/private-intel/bulk:
delete:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel:write`
'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/BulkDeleteResult'
application/x-yaml:
schema:
$ref: '#/components/schemas/BulkDeleteResult'
application/edn:
schema:
$ref: '#/components/schemas/BulkDeleteResult'
application/transit+json:
schema:
$ref: '#/components/schemas/BulkDeleteResult'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/BulkDeleteResult'
summary: DELETE many entities at once
parameters:
- in: query
name: wait_for
description: wait for created entities to be available for search
required: false
schema:
type: boolean
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/BulkRefs'
application/x-yaml:
schema:
$ref: '#/components/schemas/BulkRefs'
application/edn:
schema:
$ref: '#/components/schemas/BulkRefs'
application/transit+json:
schema:
$ref: '#/components/schemas/BulkRefs'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/BulkRefs'
description: a new Bulk Delete object
required: true
/iroh/private-intel/mitre/tactic/search:
get:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `global-intel:read,private-intel:read`
'
responses:
'200':
description: ''
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/x-yaml:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/edn:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/transit+json:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
application/transit+msgpack:
schema:
type: array
items:
$ref: '#/components/schemas/TacticView'
summary: Return requested tactics with all techniques
parameters:
- in: query
name: ids
description: Mitre Tactic ids to search
required: false
style: form
explode: true
schema:
type: array
items:
type: string
/iroh/private-intel/mitre/tactic/{mitre-id}:
get:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `global-intel:read,private-intel:read`
'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/TacticView'
application/x-yaml:
schema:
$ref: '#/components/schemas/TacticView'
application/edn:
schema:
$ref: '#/components/schemas/TacticView'
application/transit+json:
schema:
$ref: '#/components/schemas/TacticView'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/TacticView'
summary: Return requested tactic with all techniques
parameters:
- in: path
name: mitre-id
description: The identifier of the MITRE attack pattern to retrieve.
required: true
schema:
type: string
/iroh/private-intel/mitre/technique/incidents:
get:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `private-intel:read`
'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/TotalIncidentsPerTechnique'
application/x-yaml:
schema:
$ref: '#/components/schemas/TotalIncidentsPerTechnique'
application/edn:
schema:
$ref: '#/components/schemas/TotalIncidentsPerTechnique'
application/transit+json:
schema:
$ref: '#/components/schemas/TotalIncidentsPerTechnique'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/TotalIncidentsPerTechnique'
summary: Retrieve the total number of incidents per technique.
parameters:
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
/iroh/private-intel/mitre/coverage-matrix:
get:
x-no-doc: false
tags:
- Private Intel
description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `global-intel:read,private-intel:read`
'
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/MitreCoverage'
application/x-yaml:
schema:
$ref: '#/components/schemas/MitreCoverage'
application/edn:
schema:
$ref: '#/components/schemas/MitreCoverage'
application/transit+json:
schema:
$ref: '#/components/schemas/MitreCoverage'
application/transit+msgpack:
schema:
$ref: '#/components/schemas/MitreCoverage'
summary: Return the Mitre coverage matrix, products metadata and any errors. Elements are optional, as are some fields.
parameters:
- in: query
name: from
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: to
description: ''
required: false
schema:
type: string
format: date-time
- in: query
name: includes
description: ''
required: false
# --- truncated at 32 KB (1081 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-private-intel-api-openapi.yml