Cyware Rules API

openapi: 3.2.0
info:
  title: Cyware Intel Exchange (CTIX) v3 Open Rules API
  version: 3.6.2
  description: 'Public Open API for Cyware Intel Exchange (formerly CTIX), Cyware''s threat intelligence platform for the ingestion, enrichment, analysis, correlation and bi-directional sharing of structured and unstructured threat intelligence using STIX 2.x and TAXII 2.x. The API covers threat data objects, intel creation and import, enrichment, rules, tags, watchlists, threat bulletins, threat investigation, dashboards, reports, PIR management, MITRE ATT&CK navigator data and platform administration.


    Intel Exchange is deployed per tenant, so the server host is the customer''s own Intel Exchange deployment; the API is mounted under `/ctixapi`.


    This document was assembled by API Evangelist from Cyware''s own published, structured API reference documents at https://ctixapiv3.cyware.com — each endpoint page is served as machine-readable markdown carrying a JSON endpoint model, and every page is indexed from that host''s llms.txt. Paths, methods, parameters, descriptions, enumerations and examples are reproduced from those documents; nothing is invented.'
  contact:
    name: Cyware
    url: https://www.cyware.com/contact-us
  termsOfService: https://www.cyware.com/legal/terms-of-use
  x-apievangelist-source: https://ctixapiv3.cyware.com/llms.txt
  x-apievangelist-method: generated
servers:
- url: https://{ctix_host}/ctixapi
  description: Tenant Intel Exchange deployment. Replace {ctix_host} with your own Intel Exchange host. Cyware documents the base URL form https://sample.domain.com/ctixapi in its authentication guide and uses https://demo.cyware.com/ctix/ as the example host in the config of its open-source MCP server.
  variables:
    ctix_host:
      default: demo.cyware.com
security:
- ctixOpenApiSignature: []
tags:
- name: Rules
  description: Rules
paths:
  /ingestion/rules/bulk-actions/:
    post:
      operationId: bulkActionOnRules
      summary: Bulk Action on Rules
      tags:
      - Rules
      description: Updates multiple rules in one operation.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/rules/bulk-action-on-rules
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  description: Pass the list of rule IDs.
                  items:
                    type: string
                    description: This is an example ID.
                    examples:
                    - 710d9cbd-68e4-42be-b23a-fb2fce1fdc40
                action:
                  type: string
                  description: Pass the bulk action to apply.
                  enum:
                  - follow
                  - unfollow
                  - active
                  - inactive
                  examples:
                  - follow
            example:
              ids:
              - 710d9cbd-68e4-42be-b23a-fb2fce1fdc40
              action: follow
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns the details of the bulk action execution of the rules execution.
                    examples:
                    - Successful
              example:
                details: Successful
  /ingestion/rules/{rule_id}/follow/:
    put:
      operationId: followOrUnfollowRule
      summary: Follow or Unfollow Rule
      tags:
      - Rules
      description: Enables you to follow or unfollow a rule.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/rules/follow-or-unfollow-rule
      parameters:
      - name: rule_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a rule.
          examples:
          - a41615f0-112f-4dab-819c-9704c323e6ae
        description: Pass the unique ID of a rule.
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                follow:
                  type: boolean
                  description: Pass true to follow a rule. Else, pass false.
                  examples:
                  - 'true'
            example:
              follow: 'true'
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  details:
                    type: string
                    description: Returns the follow or unfollow status of the specified rule ID.
                    examples:
                    - Followed Successfully
              example:
                details: Followed Successfully
  /ingestion/rules/:
    get:
      operationId: listRules
      summary: Get Rules List
      tags:
      - Rules
      description: Retrieves a list of rules from the platform.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/rules/list-rules
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve rules.
          default: '1'
          examples:
          - '1'
        description: Pass the page number to retrieve rules.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of rules to retrieve on each page.
          maxLength: 100
          default: '10'
          examples:
          - '10'
        description: Pass the number of rules to retrieve on each page.
      - name: source
        in: query
        required: false
        schema:
          type: string
          description: Pass a comma-separated list of source IDs to filter rules.
          examples:
          - 3f9a5d74-3f63-4fee-95cf-f25c809cc2xx,3f9a5d74-3f63-4fee-95cf-f25c809cc2yy
        description: Pass a comma-separated list of source IDs to filter rules.
      - name: created_by_id
        in: query
        required: false
        schema:
          type: string
          description: Pass the ID of the creator of the rules to filter.
          examples:
          - 3f9a5d74-3f63-4fee-95cf-f25c809cc2zz
        description: Pass the ID of the creator of the rules to filter.
      - name: status
        in: query
        required: false
        schema:
          type: string
          description: Pass the status of the rules. By default, rules with all statuses are retrieved.
          enum:
          - ' DRAFT'
          - ACTIVE
          - ' INACTIVE'
          examples:
          - ACTIVE
        description: Pass the status of the rules. By default, rules with all statuses are retrieved.
      - name: last_active_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active time in epoch format to filter rules.
          examples:
          - '1703743485'
        description: Pass the last active time in epoch format to filter rules.
      - name: last_active_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the last active time in epoch format to filter rules.
          examples:
          - '1703743400'
        description: Pass the last active time in epoch format to filter rules.
      - name: created_from
        in: query
        required: false
        schema:
          type: string
          description: Pass the creation time in epoch format to filter rules.
          examples:
          - '1703743401'
        description: Pass the creation time in epoch format to filter rules.
      - name: created_to
        in: query
        required: false
        schema:
          type: string
          description: Pass the creation time in epoch format to filter rules.
          examples:
          - '1703743486'
        description: Pass the creation time in epoch format to filter rules.
      - name: is_manual_run
        in: query
        required: false
        schema:
          type: string
          description: Pass true to retrieve rules that are configured for manual execution only.
          examples:
          - 'true'
        description: Pass true to retrieve rules that are configured for manual execution only.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  next:
                    type: object
                    description: Returns a link to the next page of the response.
                  previous:
                    type: object
                    description: Returns a link to the previous page of the response.
                  page_size:
                    type: number
                    description: Returns the number of rules retrieved per page.
                    examples:
                    - 10
                  total:
                    type: number
                    description: Returns the total number of rules available in the platform.
                    examples:
                    - 5
                  results:
                    type: array
                    description: Returns the list of rules.
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                          description: Returns the name of the rule.
                          examples:
                          - Rule with No Conditions
                        source:
                          type: array
                          description: Returns the name of the sources of the rule.
                          items:
                            type: string
                            description: This is an example value.
                            examples:
                            - Crowdstrike
                        id:
                          type: string
                          description: Returns the rule ID.
                          examples:
                          - 710d9cbd-68e4-42be-b23a-fb2fce1fdc40
                        is_active:
                          type: boolean
                          description: Returns true if the rule is in active or draft state, else returns false.
                          examples:
                          - true
                        last_activity_on:
                          type: number
                          description: Returns the date and time at which the rule was last executed successfully.
                          examples:
                          - 0
                        ctix_created:
                          type: number
                          description: Returns the date and time at which the rule was created.
                          examples:
                          - 1632767764
                        ctix_updated:
                          type: number
                          description: Returns the date and time at which the rule was last modified.
                          examples:
                          - 1632767764
                        is_follow:
                          type: boolean
                          description: Returns true if the current user follows the rule, else returns false.
                          examples:
                          - true
                        no_conditions:
                          type: boolean
                          description: Returns true if the rule is configured with no conditions, else returns false.
                          examples:
                          - true
                        all_sources_and_collections:
                          type: boolean
                          description: Returns true if the rule is configured with all sources, else returns false.
                          examples:
                          - false
                        status:
                          type: string
                          description: Returns the status of the rule.
                          examples:
                          - ACTIVE
                        tags:
                          type: array
                          description: Returns the list of tags applied on a rule.
                          items: {}
                        created_by:
                          type: object
                          description: Returns the details of the user who created the rule.
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who created the rule.
                              examples:
                              - youremail@example.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who created the rule.
                              examples:
                              - John
                            last_name:
                              type: string
                              description: Returns the last name of the user who created the rule.
                              examples:
                              - Doe
                            id:
                              type: string
                              description: Returns the unique identifier of the user who created the rule.
                              examples:
                              - 4745c73d-c4f8-4194-99ad-d35af61f842c
                        updated_by:
                          type: object
                          description: Returns the details of the user who last modified the rule.
                          properties:
                            email:
                              type: string
                              description: Returns the email address of the user who last updated the rule.
                              examples:
                              - youremail@example.com
                            first_name:
                              type: string
                              description: Returns the first name of the user who last updated the rule.
                              examples:
                              - John
                            last_name:
                              type: string
                              description: Returns the last name of the user who last updated the rule.
                              examples:
                              - Doe
                            id:
                              type: string
                              description: Returns the unique identifier of the user who last updated the rule.
                              examples:
                              - 4745c73d-c4f8-4194-99ad-d35af61f842c
                        trigger_on_update:
                          type: boolean
                          description: Returns true if the rule is configured to trigger on an update, else returns false.
                          examples:
                          - false
              example:
                next: {}
                previous: {}
                page_size: 10
                total: 5
                results:
                - name: Rule with No Conditions
                  source:
                  - Crowdstrike
                  id: 710d9cbd-68e4-42be-b23a-fb2fce1fdc40
                  is_active: true
                  last_activity_on: 0
                  ctix_created: 1632767764
                  ctix_updated: 1632767764
                  is_follow: true
                  no_conditions: true
                  all_sources_and_collections: false
                  status: ACTIVE
                  tags: []
                  created_by:
                    email: youremail@example.com
                    first_name: John
                    last_name: Doe
                    id: 4745c73d-c4f8-4194-99ad-d35af61f842c
                  updated_by:
                    email: youremail@example.com
                    first_name: John
                    last_name: Doe
                    id: 4745c73d-c4f8-4194-99ad-d35af61f842c
                  trigger_on_update: false
      x-alternate-documents:
      - title: Get Rules List with Minimal Details
        operationId: listRulesWithMinimalDetails
        url: https://ctixapiv3.cyware.com/rules/list-rules-with-minimal-details
  /ingestion/rules/{rule_id}/:
    get:
      operationId: ruleDetails
      summary: Get Rule Details
      tags:
      - Rules
      description: Retrieves the details of a rule.
      externalDocs:
        description: Cyware Intel Exchange API reference
        url: https://ctixapiv3.cyware.com/rules/rule-details
      parameters:
      - name: page
        in: query
        required: false
        schema:
          type: string
          description: Pass the page number to retrieve records.
          default: '1'
        description: Pass the page number to retrieve records.
      - name: page_size
        in: query
        required: false
        schema:
          type: string
          description: Pass the number of records to retrieve on each page.
          maxLength: 100
          default: '10'
        description: Pass the number of records to retrieve on each page.
      - name: rule_id
        in: path
        required: true
        schema:
          type: string
          description: Pass the unique ID of a rule.
          examples:
          - 0039ac88-7fe2-4f0e-a472-7ccfe2f1db49
        description: Pass the unique ID of a rule.
      responses:
        '200':
          description: HTTP 200 response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Returns the ID of the rule.
                    examples:
                    - 1322b13d-f866-4a82-a61b-c95cd191ee76
                  name:
                    type: string
                    description: Returns the name of the rule.
                    examples:
                    - Rule with Simple Condition
                  description:
                    type: string
                    description: Returns the description of the rule.
                    examples:
                    - Rule with Simple Condition
                  actions:
                    type: array
                    description: Returns the list of actions applied to the rule.
                    items:
                      type: object
                      properties:
                        extra_fields:
                          type: object
                          description: Returns extra parameters required for the action execution.
                          properties:
                            account:
                              type: object
                              description: Returns the account configuration used to execute the action.
                              properties:
                                extra_fields:
                                  type: object
                                  description: Returns the additional fields associated with the account
                                ssl_encrypted:
                                  type: boolean
                                  description: Indicates whether SSL encryption is enabled for this account.
                                  examples:
                                  - 'true'
                                access_key:
                                  type: object
                                  description: Placeholder for an access key.
                                secret_key:
                                  type: object
                                  description: Placeholder for a secret key.
                                id:
                                  type: string
                                  description: The unique identifier for the account.
                                  examples:
                                  - 8325a2a6-16a0-4806-b1ce-f049168515b3
                                name:
                                  type: string
                                  description: The name of the account.
                                  examples:
                                  - default account
                                is_active:
                                  type: boolean
                                  description: Indicates whether the account is currently active.
                                  examples:
                                  - 'true'
                            operation:
                              type: object
                              description: Returns the action type to be performed on the label.
                              properties:
                                id:
                                  type: string
                                  description: Returns the unique identifier for the operation.
                                  examples:
                                  - '0'
                                name:
                                  type: string
                                  description: Returns the name of the operation
                                  examples:
                                  - Add
                            labels_list:
                              type: array
                              description: List of labels to apply as part of the action.
                              items:
                                type: object
                                properties:
                                  colour_code:
                                    type: object
                                    description: Returns the colour code defined in the instance.
                                  created:
                                    type: number
                                    description: Returns the Unix timestamp when the label was created.
                                    examples:
                                    - '1643809109'
                                  created_by:
                                    type: object
                                    description: Returns the details of the user who created the report.
                                    properties:
                                      email:
                                        type: string
                                        description: Returns the email address of the user who created the report.
                                        examples:
                                        - youremail@example.com
                                      first_name:
                                        type: string
                                        description: Returns the first name of the user who created the report.
                                        examples:
                                        - System
                                      id:
                                        type: string
                                        description: Returns the ID of the user who created the report.
                                        examples:
                                        - 010f5d90-f510-40e5-82a0-dd90f4546dd2
                                      last_name:
                                        type: string
                                        description: Returns the last name of the user who created the report.
                                        examples:
                                        - Default1
                                  id:
                                    type: string
                                    description: Returns the unique identifier for the label.
                                    examples:
                                    - f63c98e5-cc3f-4886-8dab-9453e5918a8b
                                  modified:
                                    type: number
                                    description: Returns the Unix timestamp when the label was last modified.
                                    examples:
                                    - '1643809109'
                                  modified_by:
                                    type: object
                                    description: Returns the details of the user who modified the report.
                                    properties:
                                      email:
                                        type: string
                                        description: Returns the email address of the user who last modified the report.
                                        examples:
                                        - youremail@example.com
                                      first_name:
                                        type: string
                                        description: Returns the first name of the user who last modified the report.
                                        examples:
                                        - System
                                      id:
                                        type: string
                                        description: Returns the user ID of the user who last modified the report.
                                        examples:
                                        - 010f5d90-f510-40e5-82a0-dd90f4546dd2
                                      last_name:
                                        type: string
                                        description: Returns the last name of the user who last modified the report.
                                        examples:
                                        - Default1
                                  name:
                                    type: string
                                    description: Returns the name of the label.
                                    examples:
                                    - APT
                                  type:
                                    type: string
                                    description: Returns the label type.
                                    examples:
                                    - automated
                        action:
                          type: object
                          description: Returns the action that will be triggered.
                          properties:
                            id:
                              type: string
                              description: Returns the unique identifier of the action.
                              examples:
                              - 87439e16-0e1c-43c6-ace1-1a4584a1249a
                            title:
                              type: string
                              description: Returns the title of the action.
                              examples:
                              - Update Tag
                            slug:
                              type: string
                              description: Returns the short, URL-safe identifier for the action.
                              examples:
                              - update_tag
                            tp_apps_actions:
                              type: array
                              description: Returns the third-party application mappings for this action.
                              items:
                                type: object
                                properties:
                                  id:
                                    type: string
                                    description: Returns the unique ID linking the app to the action.
                                    examples:
                                    - 43ed6977-a58c-407b-be3e-19f490d27bca
                                  title:
                                    type: string
                                    description: Returns the name of the third-party app.
                                    examples:
                                    - CTIX
                                  is_active:
                                    type: boolean
                                    description: Indicates if the app is currently active.
                                    examples:
                                    - 'true'
                                  app_config_unique_id:
                                    type: string
                                    description: Returns the unique identifier for the app’s configuration instance.
                                    examples:
                                    - 8325a2a6-16a0-4806-b1ce-f049168515b3
                            related_fields:
                              type: array
                              description: Returns the field required to configure the action.
                              items:
                                type: object
                                properties:
                                  key:
                                    type: string
                                    description: Returns the unique identifier of the field.
                                    examples:
                                    - operation
                                  order:
                                    type: number
                                    description: Returns the position of the field in the UI or logic flow.
                                    examples:
                                    - '3'
                                  rules:
                                    type: object
                                    description: Returns the validation rules.
                                    properties:
                                      required:
                                        type: boolean
                                        description: Returns a boolean indicating whether the field is mandatory when configuring the rule action.
                                        examples:
                                        - 'true'
                                  field_type:
                                    type: string
                                    description: Returns the UI input type for the field.
                                    examples:
                                    - select
                                  identifier:
                                    type: array
                                    description: Returns a list of modules or entities that this field is associated with.
                                    items:
                                      type: string
                                      description: This is an example value.
                                      examples:
                                      - rule
                                  display_name:
                                    type: string
                                    description: Returns the display name.
                                    examples:
                                    - Operation
                        app_config:
                          type: object
                          description: Returns the app configuration used to execute the action.
                          properties:
                            id:
                              type: string
                              description: Returns the unique identifier for the app configuration.
                              examples:
                              - 43ed6977-a58c-407b-be3e-19f490d27bca
                            title:
                              typ

# --- truncated at 32 KB (106 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cyware/refs/heads/main/openapi/cyware-rules-api-openapi.yml