Netography Detect and Respond - Context Creation Models API
The Detect and Respond - Context Creation Models API from Netography — 6 operation(s) for detect and respond - context creation models.
OpenAPI Specification
openapi: 3.0.0
info:
title: Netography (Vectra Fusion) Analytics Detect and Respond - Context Creation Models API
version: '1.0'
description: Netography Fusion (now Vectra Fusion) REST API. Harvested from the provider's public API reference (docs.fusion.vectra.ai, formerly docs.netography.com).
x-apievangelist-source: https://docs.fusion.vectra.ai/api-reference (formerly docs.netography.com); harvested from embedded OpenAPI blocks
x-apievangelist-method: searched
x-apievangelist-generated: '2026-07-20'
servers:
- url: https://api.netography.com
description: Netography API
tags:
- name: Detect and Respond - Context Creation Models
paths:
/api/v1/rule-engine/ccms:
get:
operationId: v1_context_creation_models_get
summary: List Context Creation Models
description: Returns an array of Context Creation Models.
tags:
- Detect and Respond - Context Creation Models
responses:
'200':
description: List of Requested Context Creation Models
content:
application/json:
schema:
type: object
additionalProperties: false
properties:
meta:
type: object
additionalProperties: false
readOnly: true
properties:
code:
description: API response code. 200 ok, 400 you did something wrong. 500 we did something wrong
type: integer
readOnly: true
format: int32
count:
description: Number of documents retrieved or updated.
type: integer
readOnly: true
format: int32
data:
type: array
items:
allOf:
- description: Context Creation Model Record
type: object
allOf:
- type: object
properties:
action:
description: Action for the context model
type: array
items:
type: object
properties:
type:
type: string
field:
type: string
context:
type: string
labels:
type: array
items:
type: string
bypassdisplay:
description: If true, portal and API will not display new events
type: boolean
bypassrule:
description: If true, alerts will not be processed by policies and integrations
type: boolean
categories:
description: Categories for the context model
type: array
items:
type: string
description:
description: Context model description
type: string
discards:
description: Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model
type: array
items:
type: string
enabled:
description: If true, the context model is enabled
type: boolean
expiration:
description: Number of seconds the context creation model will remain active
type: integer
factors:
description: Factors for the context model
type: array
items:
type: string
name:
description: Name of the context model
type: string
rollupperiod:
description: The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)
type: integer
search_by:
description: Search criteria for the context model
type: array
items:
type: object
properties:
search:
type: array
items:
type: string
type:
type: string
thresholds:
description: Thresholds for the context model
type: array
items:
type: object
properties:
severity:
type: string
threshold:
type: string
track_by:
description: Tracking criteria for the context model
type: array
items:
type: array
items:
type: string
updateinterval:
description: When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled
type: integer
algo_record_type:
description: The context of record to be used for the context model
type: string
enum:
- flow
- dns
properties:
algo_type:
description: Context model type
type: string
beta:
description: If true, it's a beta context model
type: boolean
created:
description: The time at which record was created
type: integer
id:
description: Context model ID
type: string
recommended:
description: If true, it's a recomended context model
type: boolean
subscription:
description: Subscription for the context model
type: object
properties:
all:
type: string
subscriptiontype:
description: Subscription type for the context model
type: string
system:
description: If true, it's a system context model
type: boolean
systemdefault:
description: If true, it's a system default context model
type: boolean
updated:
description: The time at which record was was last updated
type: integer
'400':
description: Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
'401':
description: Access token is missing or invalid
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
'403':
description: Access is forbidden
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
default:
description: Unknown Error Occurred
content:
application/json:
schema:
type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
/api/v1/rule-engine/ccm:
post:
operationId: v1_context_creation_model_post
summary: Create Context Creation Model
description: Creates a context creation model from the data that's been supplied. Do not provide an id. IDs are auto generated
tags:
- Detect and Respond - Context Creation Models
requestBody:
description: Context Creation Model to be added
required: true
content:
application/json:
schema:
description: Context Creation Model Create or Update Config
type: object
required:
- description
- expiration
- name
- rollupperiod
- search_by
- thresholds
- track_by
- algo_record_type
allOf:
- type: object
properties:
action:
description: Action for the context model
type: array
items:
type: object
properties:
type:
type: string
field:
type: string
context:
type: string
labels:
type: array
items:
type: string
bypassdisplay:
description: If true, portal and API will not display new events
type: boolean
bypassrule:
description: If true, alerts will not be processed by policies and integrations
type: boolean
categories:
description: Categories for the context model
type: array
items:
type: string
description:
description: Context model description
type: string
discards:
description: Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model
type: array
items:
type: string
enabled:
description: If true, the context model is enabled
type: boolean
expiration:
description: Number of seconds the context creation model will remain active
type: integer
factors:
description: Factors for the context model
type: array
items:
type: string
name:
description: Name of the context model
type: string
rollupperiod:
description: The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)
type: integer
search_by:
description: Search criteria for the context model
type: array
items:
type: object
properties:
search:
type: array
items:
type: string
type:
type: string
thresholds:
description: Thresholds for the context model
type: array
items:
type: object
properties:
severity:
type: string
threshold:
type: string
track_by:
description: Tracking criteria for the context model
type: array
items:
type: array
items:
type: string
updateinterval:
description: When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled
type: integer
algo_record_type:
description: The context of record to be used for the context model
type: string
enum:
- flow
- dns
responses:
'201':
description: Requested Context Creation Model
content:
application/json:
schema:
type: object
additionalProperties: false
properties:
meta:
type: object
additionalProperties: false
readOnly: true
properties:
code:
description: API response code. 200 ok, 400 you did something wrong. 500 we did something wrong
type: integer
readOnly: true
format: int32
count:
description: Number of documents retrieved or updated.
type: integer
readOnly: true
format: int32
data:
type: array
maxItems: 1
items:
allOf:
- description: Context Creation Model Record
type: object
allOf:
- type: object
properties:
action:
description: Action for the context model
type: array
items:
type: object
properties:
type:
type: string
field:
type: string
context:
type: string
labels:
type: array
items:
type: string
bypassdisplay:
description: If true, portal and API will not display new events
type: boolean
bypassrule:
description: If true, alerts will not be processed by policies and integrations
type: boolean
categories:
description: Categories for the context model
type: array
items:
type: string
description:
description: Context model description
type: string
discards:
description: Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model
type: array
items:
type: string
enabled:
description: If true, the context model is enabled
type: boolean
expiration:
description: Number of seconds the context creation model will remain active
type: integer
factors:
description: Factors for the context model
type: array
items:
type: string
name:
description: Name of the context model
type: string
rollupperiod:
description: The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)
type: integer
search_by:
description: Search criteria for the context model
type: array
items:
type: object
properties:
search:
type: array
items:
type: string
type:
type: string
thresholds:
description: Thresholds for the context model
type: array
items:
type: object
properties:
severity:
type: string
threshold:
type: string
track_by:
description: Tracking criteria for the context model
type: array
items:
type: array
items:
type: string
updateinterval:
description: When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled
type: integer
algo_record_type:
description: The context of record to be used for the context model
type: string
enum:
- flow
- dns
properties:
algo_type:
description: Context model type
type: string
beta:
description: If true, it's a beta context model
type: boolean
created:
description: The time at which record was created
type: integer
id:
description: Context model ID
type: string
recommended:
description: If true, it's a recomended context model
type: boolean
subscription:
description: Subscription for the context model
type: object
properties:
all:
type: string
subscriptiontype:
description: Subscription type for the context model
type: string
system:
description: If true, it's a system context model
type: boolean
systemdefault:
description: If true, it's a system default context model
type: boolean
updated:
description: The time at which record was was last updated
type: integer
'400':
description: Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
'401':
description: Access token is missing or invalid
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
'403':
description: Access is forbidden
content:
application/json:
schema:
allOf:
- type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
- type: object
properties:
status: {}
name: {}
message: {}
default:
description: Unknown Error Occurred
content:
application/json:
schema:
type: object
required:
- status
- name
- message
additionalProperties: false
properties:
status:
description: "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n"
type: integer
readOnly: true
format: int32
name:
description: They type of error
type: string
readOnly: true
message:
description: description of the error
type: string
readOnly: true
/api/v1/rule-engine/ccm/{id}:
get:
operationId: v1_context_creation_model_id_get
summary: Fetch Context Creation Model
description: Fetches a specific context creation model from the ID supplied in the path.
tags:
- Detect and Respond - Context Creation Models
parameters:
- name: id
in: path
required: true
description: The ID of the context creation model to be returned.
schema:
type: string
responses:
'200':
description: Requested Context Creation Model
content:
application/json:
schema:
type: object
additionalProperties: false
properties:
meta:
type: object
additionalProperties: false
readOnly: true
properties:
code:
description: API response code. 200 ok, 400 you did something wrong. 500 we did something wrong
type: integer
readOnly: true
format: int32
count:
description: Number of documents retrieved or updated.
type: integer
readOnly: true
format: int32
data:
type: array
maxItems: 1
items:
allOf:
- description: Context Creation Model Record
type: object
allOf:
- type: object
properties:
action:
description: Action for the context model
type: array
items:
type: object
properties:
type:
type: string
field:
type: string
context:
type: string
labels:
type: array
items:
type: string
bypassdisplay:
description: If true, portal and API will not display new events
type: boolean
bypassrule:
description: If true, alerts will not be processed by policies and integrations
type: boolean
categories:
description: Categories for the context model
type: array
items:
type: string
description:
description: Context model description
type: string
discards:
description: Discard lists are
# --- truncated at 32 KB (98 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/netography/refs/heads/main/openapi/netography-detect-and-respond-context-creation-models-api-openapi.yml