openapi: 3.2.0
info:
title: Cyware Intel Exchange (CTIX) v3 Open Create Intel via Open API API
version: 3.6.2
description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.
Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.
This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
contact:
name: Cyware
url: https://www.cyware.com/contact-us
termsOfService: https://www.cyware.com/legal/terms-of-use
x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
variables:
ctix_host:
default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Create Intel via Open API
description: Create Intel via Open API
paths:
/conversion/quick-intel/open-api/:
post:
operationId: createIntelViaOpenApi
summary: Create Intel via Open API
tags:
- Create Intel via Open API
description: 'Create intel with additional details such as the source and collection. You can also include details for each object, such as description, notes, custom attributes, and more.
<Accordion attributes=''{"style":{"width":"100%"}}''>
<AccordionItem title="The All SDOs Object" iconUrl=""><p>The <code class="slate-code">all_sdos</code> object accepts <code class="slate-code">all_iocs</code> and the SDO type as the key, and a list of objects for the respective IOC and SDO type.</p>
<p>For a list of the supported SDO types, refer to the following table.</p>
<p>Title</p>
<p>SDO Key</p>
<p>Vulnerability</p>
<p><code class="slate-code">vulnerabilities</code></p>
<p>Malware</p>
<p><code class="slate-code">malwares</code></p>
<p>Campaign</p>
<p><code class="slate-code">campaigns</code></p>
<p>Threat Actor</p>
<p><code class="slate-code">threat_actor</code></p>
<p>Intrusion Set</p>
<p><code class="slate-code">intrusion_sets</code></p>
<p>Attack Pattern</p>
<p><code class="slate-code">attack_patterns</code></p>
<p>Incident</p>
<p><code class="slate-code">incidents</code></p>
<p>Course of Action</p>
<p><code class="slate-code">course_of_actions</code></p>
<p>Identity</p>
<p><code class="slate-code">identities</code></p>
<p>Tool</p>
<p><code class="slate-code">tools</code></p>
<p>Infrastructure</p>
<p><code class="slate-code">infrastructures</code></p>
<p>Location</p>
<p><code class="slate-code">locations</code></p>
<p>Malware Analysis</p>
<p><code class="slate-code">malware_analysis</code></p>
<p>Custom Objects</p>
<p><code class="slate-code">custom_objects</code></p>
<p>File</p>
<p><code class="slate-code">files</code></p>
<p>Grouping</p>
<p><code class="slate-code">groupings</code></p>
<p>Indicator</p>
<p><code class="slate-code">indicators</code></p>
<p>Marking Definition</p>
<p><code class="slate-code">marking_definitions</code></p>
<p>Note</p>
<p><code class="slate-code">notes</code></p>
<p>Observed Data</p>
<p><code class="slate-code">observed_datas</code></p>
<p>Opinion</p>
<p><code class="slate-code">opinions</code></p>
<p>Relatioship</p>
<p><code class="slate-code">relationships</code></p>
<p>Observables</p>
<p><code class="slate-code">cyber_observables</code></p>
<p>Software</p>
<p><code class="slate-code">softwares</code></p></AccordionItem>
<AccordionItem title="The All IOCs Object" iconUrl=""><p>The <code class="slate-code">all_iocs</code> object accepts the IOC type as the key and a list of objects for the respective IOC type.</p>
<p>For a list of the supported IOC types, refer to the following table.</p>
<p>IOC Type</p>
<p>IOC Key</p>
<p>IPv4</p>
<p><code class="slate-code">ipv4</code></p>
<p>IPv6</p>
<p><code class="slate-code">ipv6</code></p>
<p>Domain</p>
<p><code class="slate-code">domain</code></p>
<p>URL</p>
<p><code class="slate-code">url</code></p>
<p>Email Address</p>
<p><code class="slate-code">email_address</code></p>
<p>MD5</p>
<p><code class="slate-code">md5</code></p>
<p>SHA1</p>
<p><code class="slate-code">sha1</code></p>
<p>SHA224</p>
<p><code class="slate-code">sha224</code></p>
<p>SHA256</p>
<p><code class="slate-code">sha256</code></p>
<p>SHA384</p>
<p><code class="slate-code">sha384</code></p>
<p>SHA512</p>
<p><code class="slate-code">sha512</code></p>
<p>SSDEEP</p>
<p><code class="slate-code">ssdeep</code></p>
<p></p></AccordionItem>
</Accordion>'
externalDocs:
description: Cyware Intel Exchange API reference
url: https://ctixapiv3.cyware.com/create-intel-via-open-api/create-intel-via-open-api
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
source:
type: string
description: "Pass the name of the source to map the intel. \nIf the passed source name does not exist in the platform, then a new source is automatically created in the Miscellaneous source category."
default: Miscellaneous
examples:
- Open API Source
collection:
type: string
description: 'Pass the name of the source collection to associate with the source.
If the passed collection name does not exist in the platform, then a new collection is automatically created.'
default: Free Text
examples:
- API Import
metadata:
type: object
description: Pass additional information to associate with the intel.
properties:
confidence:
type: number
description: Pass the Source Confidence Score associated with all the intel. This score is applied to all the threat data objects in the payload.
default: 'null'
examples:
- '80'
tlp:
type: string
description: Pass the TLP to associate with the intel. This TLP is applied to all the threat data objects in the payload.
enum:
- GREEN
- ' AMBER'
- RED
- WHITE
- NONE
examples:
- RED
labels:
type: array
description: Pass a list of tags to associate with the intel.
items:
type: string
description: Pass the tag name to associate with the intel.
examples:
- open_api_objects
title:
type: string
description: Pass the title of the intel within 100 characters.
examples:
- new intel
all_sdos:
type: object
description: Pass the SDO and IOC objects to add to the intel. For more information, see *The All SDOs Object* table.
properties:
all_iocs:
type: object
description: Pass details of threat data objects you want to create as intel in Intel Exchange.
properties:
ipv4:
type: array
description: Pass IPv4 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of an IPv4.
examples:
- 1.2.34.21
description:
type: string
description: Pass the description of the IOC or SDO within 5000 characters.
examples:
- sample description
is_false_positive:
type: boolean
description: Pass true to mark the IOC or SDO as False-Positive.
default: 'false'
examples:
- 'true'
notes:
type: array
description: Pass a list of note strings to add to the IOC or SDO.
items:
type: string
description: This is an example note.
examples:
- This is a sample Note attached to this indicator!
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute values in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
ipv6:
type: array
description: Pass IPv6 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of an IPv6.
examples:
- 7b6f:e96a:991b:e1f8:6e50:9bf6:3c7:2922
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute values in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
domain:
type: array
description: Pass the domain object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the domain.
examples:
- abc.com
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute values in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
url:
type: array
description: Pass the URL object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the URL.
examples:
- http://www.abc.com
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute values in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
email_address:
type: array
description: Pass the Email address object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the email address.
examples:
- john.doe@cyware.com
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute values in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
md5:
type: array
description: Pass the MD5 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the MD5.
examples:
- 00616b4b72c8a1da89ed3840fa7313e1
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
sha1:
type: array
description: Pass the SHA1 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the SHA1.
examples:
- 434c2da14ed0326cd2536a51a50341c8877cabe9
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
sha224:
type: array
description: Pass the SHA224 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the SHA224.
examples:
- 90a3ed9e32b2aaf4c61c410eb925426119e1a9dc53d4286ade99a809
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
sha256:
type: array
description: Pass the SHA256 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of SHA256.
examples:
- 003b3e35daeb64f1608b31e98db56044c0294703dfc39ce31e25b2ac66933699
custom_attributes:
type: object
description: Pass the custom attribute names and the attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
sha384:
type: array
description: Pass the SHA384 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of SHA384.
examples:
- f2360531b6d70f20650e28f79c3e327c107842379a5ece06b0485aa21bf10ef0a0f307e50752550daab99f5bb6afb7ea
custom_attributes:
type: object
description: Pass the custom attribute name and the attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
sha512:
type: array
description: Pass the SHA512 object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of SHA512.
examples:
- 0ef857c3298a01de7e7cf21d60b38709adf28ae711d1e72be1f43a91b18ed1c4956fd75294db5b40bf241f50507abdccdd133364cfef6f6e5c9b908279816223
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
ssdeep:
type: array
description: Pass the SSDEEP object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the SSDEEP.
examples:
- 3:BWcSn:EcSn
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
vulnerabilities:
type: array
description: Pass the vulnerability object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the vulnerability.
examples:
- vul1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
malwares:
type: array
description: Pass the malware object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the malware.
examples:
- malware1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-value pairs. The custom attribute name must start with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
campaigns:
type: array
description: Pass the campaign object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the campaign.
examples:
- campaign1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-pairs. The custom attribute name starts with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
threat_actors:
type: array
description: Pass the threat actor object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the threat actor.
examples:
- threatactor1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-pairs. The custom attribute name starts with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
intrusion_sets:
type: array
description: Pass the intrusion set's object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the intrusion set.
examples:
- intrusionset1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-pairs. The custom attribute name starts with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
attack_patterns:
type: array
description: Pass the attack pattern's object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the attack pattern.
examples:
- attackpattern1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-pairs. The custom attribute name starts with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
course_of_actions:
type: array
description: Pass the course of action's object details.
items:
type: object
properties:
value:
type: string
description: Pass the value of the course of action.
examples:
- coa1
custom_attributes:
type: object
description: Pass the custom attribute name and attribute value in key-pairs. The custom attribute name starts with `x_`. For example, `x_identity`.
properties:
x_custom_attribute1:
type: string
description: This is an example value.
examples:
- sample value 1
required:
- value
identities:
type: array
descrip
# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-create-intel-via-open-api-api-openapi.yml