Cisco XDR Response API

openapi: 3.2.0
info:
  title: IROH-INT Response API
  version: 1.0.107
  license:
    name: All Rights Reserved
    url: https://www.cisco.com
  contact:
    name: Cisco Security Business Group -- Advanced Threat
    email: cisco-intel-api-support@cisco.com
  description: Manage Response from modules
  x-provenance:
    method: harvested
    authored_by: Cisco XDR
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
  x-evidence:
  - type: source
    url: https://visibility.amp.cisco.com/iroh/iroh-response/index.html
  - type: raw
    url: https://visibility.amp.cisco.com/iroh/iroh-response/swagger.json
servers:
- url: https://visibility.amp.cisco.com/
security:
- iroh: []
- AuthorizationHeader: []
- oauth2:
  - telemetry
  - integration
  - private-intel
  - admin
  - cognitive
  - profile
  - inspect
  - asset
  - event
  - feedback
  - sse
  - registry
  - users
  - investigation
  - invite
  - casebook
  - orbital
  - enrich
  - oauth
  - vault
  - response
  - notification
  - global-intel:read
  - webhook
  - ao
tags:
- name: Response
  description: IROH Response
paths:
  /iroh/iroh-response/respond/observables:
    post:
      x-no-doc: false
      tags:
      - Response
      description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `response/observables:read`


        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/edn:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
      parameters:
      - in: query
        name: params
        description: ''
        required: false
        allowEmptyValue: true
        schema:
          type: string
      summary: List available actions for an observable
      requestBody:
        content:
          application/json:
            schema:
              description: a list of observables
              type: array
              items:
                $ref: '#/components/schemas/Observable'
          application/x-yaml:
            schema:
              description: a list of observables
              type: array
              items:
                $ref: '#/components/schemas/Observable'
          application/edn:
            schema:
              description: a list of observables
              type: array
              items:
                $ref: '#/components/schemas/Observable'
          application/transit+json:
            schema:
              description: a list of observables
              type: array
              items:
                $ref: '#/components/schemas/Observable'
          application/transit+msgpack:
            schema:
              description: a list of observables
              type: array
              items:
                $ref: '#/components/schemas/Observable'
        description: A simple, atomic value which has a consistent identity, and is stable enough to be attributed an intent or nature.  This is the classic 'indicator' which might appear in a data feed of bad IPs, or bad Domains.  These do not exist as objects within the CTIA storage model, so you never create an observable.
        required: true
  /iroh/iroh-response/respond/sighting:
    post:
      x-no-doc: false
      tags:
      - Response
      description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `response/sighting:read`


        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/edn:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/EnvelopedActions'
      parameters:
      - in: query
        name: params
        description: ''
        required: false
        allowEmptyValue: true
        schema:
          type: string
      summary: List available actions for a sighting
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Sighting'
          application/x-yaml:
            schema:
              $ref: '#/components/schemas/Sighting'
          application/edn:
            schema:
              $ref: '#/components/schemas/Sighting'
          application/transit+json:
            schema:
              $ref: '#/components/schemas/Sighting'
          application/transit+msgpack:
            schema:
              $ref: '#/components/schemas/Sighting'
        description: A Sighting
        required: true
  /iroh/iroh-response/respond/trigger/{module-instance-id}/{action-id}:
    post:
      x-no-doc: false
      tags:
      - Response
      description: '[required scopes](/iroh/doc/iroh-auth/#scopes): `response/trigger:write`


        '
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EnvelopedActionResult'
            application/x-yaml:
              schema:
                $ref: '#/components/schemas/EnvelopedActionResult'
            application/edn:
              schema:
                $ref: '#/components/schemas/EnvelopedActionResult'
            application/transit+json:
              schema:
                $ref: '#/components/schemas/EnvelopedActionResult'
            application/transit+msgpack:
              schema:
                $ref: '#/components/schemas/EnvelopedActionResult'
      parameters:
      - in: path
        name: module-instance-id
        description: ''
        required: true
        schema:
          type: string
      - in: path
        name: action-id
        description: ''
        required: true
        schema:
          type: string
      - in: query
        name: observable_type
        description: Observable type names
        required: false
        example: acudid
        schema:
          type: string
          enum:
          - file_path
          - mac_address
          - trend_micro_id
          - cybereason_id
          - process_args
          - s1_agent_id
          - device
          - hostname
          - certificate_common_name
          - serial_number
          - meraki_network_id
          - url
          - jamf_management_id
          - certificate_serial
          - intune_id
          - meraki_org_id
          - cisco_cm_id
          - registry_key
          - process_path
          - darktrace_id
          - process_username
          - cortex_agent_id
          - orbital_node_id
          - process_uid
          - ngfw_name
          - user
          - certificate_issuer
          - ipv6
          - email
          - cisco_uc_id
          - cvm_id
          - sha256
          - crowdstrike_id
          - google_cloud_id
          - google_chromebook_id
          - acudid
          - sha1
          - registry_name
          - md5
          - service_now_id
          - ip
          - domain
          - email_subject
          - imei
          - ngfw_id
          - amp_computer_guid
          - ms_machine_id
          - secure_access_id
          - mutex
          - processor_id
          - swc_device_id
          - registry_path
          - odns_identity
          - odns_identity_label
          - cisco_mid
          - process_name
          - pki_serial
          - meraki_node_sn
          - email_messageid
          - imsi
          - user_agent
          - process_hash
          - file_name
      - in: query
        name: observable_value
        description: ''
        required: false
        schema:
          type: string
      summary: Trigger an Action
components:
  schemas:
    NetflowType:
      example:
        parent_process_name: string
        byte_count_in: 10
        process_guid: 10
        process_path: string
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        flow_time: '2016-01-01T01:01:01.000Z'
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        parent_process_account: string
        type: NetflowEvent
        process_account_type: string
        parent_process_path: string
        parent_process_id: 10
        parent_process_args: string
        process_name: string
        process_account: string
        parent_process_account_type: string
        process_hash: string
        process_id: 10
        parent_process_hash: string
        process_username: string
        byte_count_out: 10
        process_args: string
      type: object
      properties:
        parent_process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_in:
          example: 10
          type: integer
          format: int64
        process_guid:
          example: 10
          type: integer
          format: int64
        process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        traffic:
          $ref: '#/components/schemas/Traffic'
        flow_time:
          example: '2016-01-01T01:01:01.000Z'
          description: Schema definition for all date or timestamp values.  Serialized as a string, the field should follow the rules of the [ISO8601](https://en.wikipedia.org/wiki/ISO_8601) standard.
          type: string
          format: date-time
        time:
          $ref: '#/components/schemas/ObservedTime'
        parent_process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: NetflowEvent
          type: string
          enum:
          - NetflowEvent
        process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_path:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_id:
          example: 10
          type: integer
          format: int64
        parent_process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_account:
          example: string
          description: String with at most 1024 characters.
          type: string
        parent_process_account_type:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        parent_process_hash:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        byte_count_out:
          example: 10
          type: integer
          format: int64
        process_args:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - process_name
      - process_id
    ExternalReference:
      example:
        source_name: string
        description: string
        url: string
        hashes:
        - string
        external_id: string
      description: External references are used to describe pointers to information represented outside of CTIM. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.
      type: object
      properties:
        source_name:
          example: string
          description: The source within which the external-reference is defined (system, registry, organization, etc.)
          type: string
        description:
          example: string
          description: Markdown string with at most 5000 characters.
          type: string
        url:
          example: string
          description: A URL reference to an external resource.
          type: string
        hashes:
          example:
          - string
          description: Specifies a dictionary of hashes for the contents of the url.
          type: array
          items:
            type: string
        external_id:
          example: string
          description: An identifier for the external reference content.
          type: string
      additionalProperties: false
      required:
      - source_name
    ActionResult:
      type: object
      properties:
        status:
          type: string
          enum:
          - failure
          - success
      additionalProperties: false
      required:
      - status
    RegistryRenameType:
      example:
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        process_id: 10
        process_name: string
        process_guid: 10
        process_username: string
        registry_key: string
        type: RegistryRenameEvent
        registry_old_key: string
      type: object
      properties:
        time:
          $ref: '#/components/schemas/ObservedTime'
        process_id:
          example: 10
          type: integer
          format: int64
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_guid:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        registry_key:
          example: string
          description: String with at most 1024 characters.
          type: string
        type:
          example: RegistryRenameEvent
          type: string
          enum:
          - RegistryRenameEvent
        registry_old_key:
          example: string
          description: String with at most 1024 characters.
          type: string
      additionalProperties: false
      required:
      - time
      - process_id
      - process_name
      - registry_key
      - type
      - registry_old_key
    HTTPType:
      example:
        process_guid: 10
        traffic:
          destination_host_name: string
          protocol: 10
          source_ip: string
          destination_subnet: string
          destination_ip: string
          source_subnet: string
          destination_port: 10
          direction: incoming
          source_port: 10
        method: CONNECT
        time:
          start_time: '2016-01-01T01:01:01.000Z'
          end_time: '2016-01-01T01:01:01.000Z'
        type: HTTPEvent
        host: string
        process_name: string
        process_id: 10
        process_username: string
        query: string
        encrypted: true
        url_port: 10
      type: object
      properties:
        process_guid:
          example: 10
          type: integer
          format: int64
        traffic:
          $ref: '#/components/schemas/Traffic'
        method:
          example: CONNECT
          type: string
          enum:
          - OPTIONS
          - PATCH
          - TRACE
          - HEAD
          - POST
          - CONNECT
          - GET
          - PUT
        time:
          $ref: '#/components/schemas/ObservedTime'
        type:
          example: HTTPEvent
          type: string
          enum:
          - HTTPEvent
        host:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_name:
          example: string
          description: String with at most 1024 characters.
          type: string
        process_id:
          example: 10
          type: integer
          format: int64
        process_username:
          example: string
          description: String with at most 1024 characters.
          type: string
        query:
          example: string
          description: String with at most 5000 characters.
          type: string
        encrypted:
          example: true
          type: boolean
        url_port:
          example: 10
          type: integer
          format: int64
      additionalProperties: false
      required:
      - traffic
      - time
      - type
      - host
      - process_name
      - process_id
    Context:
      example:
        http_events:
        - process_guid: 10
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          method: CONNECT
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: HTTPEvent
          host: string
          process_name: string
          process_id: 10
          process_username: string
          query: string
          encrypted: true
          url_port: 10
        process_create_events:
        - parent_process_name: string
          process_guid: 10
          parent_process_guid: 10
          process_disposition: string
          parent_process_size: 10
          process_size: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_disposition: string
          type: ProcessCreateEvent
          parent_process_username: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          parent_creation_time: '2016-01-01T01:01:01.000Z'
          process_args: string
        registry_delete_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryDeleteEvent
          registry_value: string
        file_modify_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileModifyEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_set_events:
        - process_guid: 10
          registry_data: string
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: RegistrySetEvent
          registry_data_length: 10
          registry_value: string
          registry_key: string
          process_name: string
          process_id: 10
          process_username: string
        file_create_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileCreateEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        registry_create_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryCreateEvent
        library_load_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          type: LibraryLoadEvent
          dll_library_name: string
          dll_library_path: string
        file_move_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileMoveEvent
          old_name: string
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          new_name: string
        file_delete_events:
        - file_name: string
          process_guid: 10
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          type: FileDeleteEvent
          file_path: string
          process_name: string
          process_id: 10
          process_username: string
          failed: false
        netflow_events:
        - parent_process_name: string
          byte_count_in: 10
          process_guid: 10
          process_path: string
          traffic:
            destination_host_name: string
            protocol: 10
            source_ip: string
            destination_subnet: string
            destination_ip: string
            source_subnet: string
            destination_port: 10
            direction: incoming
            source_port: 10
          flow_time: '2016-01-01T01:01:01.000Z'
          time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          parent_process_account: string
          type: NetflowEvent
          process_account_type: string
          parent_process_path: string
          parent_process_id: 10
          parent_process_args: string
          process_name: string
          process_account: string
          parent_process_account_type: string
          process_hash: string
          process_id: 10
          parent_process_hash: string
          process_username: string
          byte_count_out: 10
          process_args: string
        registry_rename_events:
        - time:
            start_time: '2016-01-01T01:01:01.000Z'
            end_time: '2016-01-01T01:01:01.000Z'
          process_id: 10
          process_name: string
          process_guid: 10
          process_username: string
          registry_key: string
          type: RegistryRenameEvent
          registry_old_key: string
      description: Context including the event type that best fits the type of the sighting.
      type: object
      properties:
        http_events:
          example:
          - process_guid: 10
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            method: CONNECT
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: HTTPEvent
            host: string
            process_name: string
            process_id: 10
            process_username: string
            query: string
            encrypted: true
            url_port: 10
          description: a list of `HTTPType`
          type: array
          items:
            $ref: '#/components/schemas/HTTPType'
        process_create_events:
          example:
          - parent_process_name: string
            process_guid: 10
            parent_process_guid: 10
            process_disposition: string
            parent_process_size: 10
            process_size: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_disposition: string
            type: ProcessCreateEvent
            parent_process_username: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            parent_creation_time: '2016-01-01T01:01:01.000Z'
            process_args: string
          description: a list of `ProcessCreate`
          type: array
          items:
            $ref: '#/components/schemas/ProcessCreateType'
        registry_delete_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryDeleteEvent
            registry_value: string
          description: a list of `RegistryDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryDeleteType'
        file_modify_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileModifyEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileModifyType`
          type: array
          items:
            $ref: '#/components/schemas/FileModifyType'
        registry_set_events:
          example:
          - process_guid: 10
            registry_data: string
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: RegistrySetEvent
            registry_data_length: 10
            registry_value: string
            registry_key: string
            process_name: string
            process_id: 10
            process_username: string
          description: a list of `RegistrySetType`
          type: array
          items:
            $ref: '#/components/schemas/RegistrySetType'
        file_create_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileCreateEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileCreateType`
          type: array
          items:
            $ref: '#/components/schemas/FileCreateType'
        registry_create_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryCreateEvent
          description: a list of `RegistryCreateType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryCreateType'
        library_load_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            type: LibraryLoadEvent
            dll_library_name: string
            dll_library_path: string
          description: a list of `LibraryLoadType`
          type: array
          items:
            $ref: '#/components/schemas/LibraryLoadType'
        file_move_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileMoveEvent
            old_name: string
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            new_name: string
          description: a list of `FileMoveType`
          type: array
          items:
            $ref: '#/components/schemas/FileMoveType'
        file_delete_events:
          example:
          - file_name: string
            process_guid: 10
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            type: FileDeleteEvent
            file_path: string
            process_name: string
            process_id: 10
            process_username: string
            failed: false
          description: a list of `FileDeleteType`
          type: array
          items:
            $ref: '#/components/schemas/FileDeleteType'
        netflow_events:
          example:
          - parent_process_name: string
            byte_count_in: 10
            process_guid: 10
            process_path: string
            traffic:
              destination_host_name: string
              protocol: 10
              source_ip: string
              destination_subnet: string
              destination_ip: string
              source_subnet: string
              destination_port: 10
              direction: incoming
              source_port: 10
            flow_time: '2016-01-01T01:01:01.000Z'
            time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            parent_process_account: string
            type: NetflowEvent
            process_account_type: string
            parent_process_path: string
            parent_process_id: 10
            parent_process_args: string
            process_name: string
            process_account: string
            parent_process_account_type: string
            process_hash: string
            process_id: 10
            parent_process_hash: string
            process_username: string
            byte_count_out: 10
            process_args: string
          description: a list of `NetflowType`
          type: array
          items:
            $ref: '#/components/schemas/NetflowType'
        registry_rename_events:
          example:
          - time:
              start_time: '2016-01-01T01:01:01.000Z'
              end_time: '2016-01-01T01:01:01.000Z'
            process_id: 10
            process_name: string
            process_guid: 10
            process_username: string
            registry_key: string
            type: RegistryRenameEvent
            registry_old_key: string
          description: a list of `RegistryRenameType`
          type: array
          items:
            $ref: '#/components/schemas/RegistryRenameType'
      additionalProperties: false
    ErrorMessage:
      type: object
      properties:
        module_instance_id:
          type: string
        module_type_id:
          type: string
        module_instance_state:
          type: string
        code:
          type: string
        message:
          type: string
        type:
          type: string


# --- truncated at 32 KB (70 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-response-api-openapi.yml