Stellar Cyber

Stellar Cyber is an Open XDR platform that provides AI-driven security operations capabilities including threat detection, investigation, and response. The platform offers an OAS-compliant REST API that enables downstream applications to perform complex queries, join results, analyze data, and automate security operations workflows. Stellar Cyber maintains several sample Python Jupyter Notebooks in GitHub that can help build analyses outside of the platform with the API or connect custom applications.
1 APIs 0 Features
CybersecuritySecurityXDRSIEMSOARAI
GitHubOrganization
GitHubOrganization
Sources

opencollection: 1.0.0
info:
  name: Stellar Cyber Open XDR API
  version: '6.3'
request:
  auth:
    type: bearer
    token: '{{bearerToken}}'
items:
- info:
    name: Authentication
    type: folder
  items:
  - info:
      name: Get Access Token
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/access_token
      auth:
        type: bearer
        token: '{{bearerToken}}'
    docs: Generate a JWT access token using an API key. The JWT expires ten minutes after generation. Use the returned token
      as a Bearer token in subsequent API calls.
- info:
    name: Cases
    type: folder
  items:
  - info:
      name: List Cases
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/cases
      params:
      - name: limit
        value: ''
        type: query
        description: Maximum number of cases to return
      - name: offset
        value: ''
        type: query
        description: Number of cases to skip for pagination
      - name: status
        value: ''
        type: query
        description: Filter cases by status
    docs: Retrieve a list of security cases from the platform.
  - info:
      name: Create Case
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/cases
      body:
        type: json
        data: '{}'
    docs: Create a new security case in the platform.
  - info:
      name: Get Case
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/cases/:caseId
      params:
      - name: caseId
        value: ''
        type: path
        description: Unique identifier for the case
    docs: Retrieve details of a specific security case.
  - info:
      name: Update Case
      type: http
    http:
      method: PUT
      url: https://{platformHostname}/connect/api/v1/cases/:caseId
      params:
      - name: caseId
        value: ''
        type: path
        description: Unique identifier for the case
      body:
        type: json
        data: '{}'
    docs: Update the status, priority, or other attributes of a security case.
  - info:
      name: Close Case
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/cases/:caseId
      params:
      - name: caseId
        value: ''
        type: path
        description: Unique identifier for the case
    docs: Close a security case in the platform.
- info:
    name: Tenants
    type: folder
  items:
  - info:
      name: List Tenants
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/tenants
    docs: Retrieve all tenants available to the authenticated user.
  - info:
      name: Create Tenant
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/tenants
      body:
        type: json
        data: '{}'
    docs: Create a new tenant on the platform (Super Admin only).
  - info:
      name: Get Tenant
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/tenants/:tenantId
      params:
      - name: tenantId
        value: ''
        type: path
        description: Unique identifier for the tenant
    docs: Retrieve details of a specific tenant.
  - info:
      name: Update Tenant
      type: http
    http:
      method: PUT
      url: https://{platformHostname}/connect/api/v1/tenants/:tenantId
      params:
      - name: tenantId
        value: ''
        type: path
        description: Unique identifier for the tenant
      body:
        type: json
        data: '{}'
    docs: Update tenant configuration.
  - info:
      name: Delete Tenant
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/tenants/:tenantId
      params:
      - name: tenantId
        value: ''
        type: path
        description: Unique identifier for the tenant
    docs: Delete a tenant from the platform (Super Admin only).
- info:
    name: Connectors
    type: folder
  items:
  - info:
      name: List Connectors
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/connectors
    docs: Retrieve all configured data connectors.
  - info:
      name: Create Connector
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/connectors
      body:
        type: json
        data: '{}'
    docs: Create a new data connector for ingesting security telemetry.
  - info:
      name: Get Connector
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/connectors/:connectorId
      params:
      - name: connectorId
        value: ''
        type: path
        description: Unique identifier for the connector
    docs: Retrieve details of a specific connector.
  - info:
      name: Update Connector
      type: http
    http:
      method: PUT
      url: https://{platformHostname}/connect/api/v1/connectors/:connectorId
      params:
      - name: connectorId
        value: ''
        type: path
        description: Unique identifier for the connector
      body:
        type: json
        data: '{}'
    docs: Update connector configuration or checkpoint timestamp.
  - info:
      name: Delete Connector
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/connectors/:connectorId
      params:
      - name: connectorId
        value: ''
        type: path
        description: Unique identifier for the connector
    docs: Delete a data connector.
- info:
    name: Alerts
    type: folder
  items:
  - info:
      name: List Alerts
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/alerts
      params:
      - name: limit
        value: ''
        type: query
        description: Maximum number of alerts to return
      - name: offset
        value: ''
        type: query
        description: Pagination offset
      - name: status
        value: ''
        type: query
        description: Filter by alert status
    docs: Retrieve security alerts from the platform.
  - info:
      name: Update Alert
      type: http
    http:
      method: PUT
      url: https://{platformHostname}/connect/api/v1/alerts/:alertId
      params:
      - name: alertId
        value: ''
        type: path
        description: Unique identifier for the alert
      body:
        type: json
        data: '{}'
    docs: Update alert tags, status, and comments.
- info:
    name: Events
    type: folder
  items:
  - info:
      name: Ingest Events
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/events
      body:
        type: json
        data: '{}'
    docs: Add security event documents to the platform's security event index. Supports both single and bulk event ingestion.
- info:
    name: Queries
    type: folder
  items:
  - info:
      name: List Queries
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/queries
    docs: Retrieve all saved queries.
  - info:
      name: Create Query
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/queries
      body:
        type: json
        data: '{}'
    docs: Create a new saved query.
  - info:
      name: Update Query
      type: http
    http:
      method: PUT
      url: https://{platformHostname}/connect/api/v1/queries/:queryId
      params:
      - name: queryId
        value: ''
        type: path
        description: Unique identifier for the query
      body:
        type: json
        data: '{}'
    docs: Update an existing saved query.
  - info:
      name: Delete Query
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/queries/:queryId
      params:
      - name: queryId
        value: ''
        type: path
        description: Unique identifier for the query
    docs: Delete a saved query.
- info:
    name: Watchlists
    type: folder
  items:
  - info:
      name: List Watchlists
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/watchlists
    docs: Retrieve all configured watchlists.
  - info:
      name: Create Watchlist
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/watchlists
      body:
        type: json
        data: '{}'
    docs: Create a new watchlist for tracking threat indicators.
  - info:
      name: Delete Watchlist
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/watchlists/:watchlistId
      params:
      - name: watchlistId
        value: ''
        type: path
        description: Unique identifier for the watchlist
    docs: Delete a watchlist.
- info:
    name: Sensors
    type: folder
  items:
  - info:
      name: List Sensors
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/sensors
    docs: Retrieve all sensors registered with the platform.
  - info:
      name: Get Sensor
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/sensors/:sensorId
      params:
      - name: sensorId
        value: ''
        type: path
        description: Unique identifier for the sensor
    docs: Retrieve information about a specific sensor.
  - info:
      name: Delete Sensor
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/sensors/:sensorId
      params:
      - name: sensorId
        value: ''
        type: path
        description: Unique identifier for the sensor
    docs: Delete a sensor from the platform.
- info:
    name: Reports
    type: folder
  items:
  - info:
      name: List Reports
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/reports
    docs: Retrieve all available security reports.
  - info:
      name: Create Report
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/reports
      body:
        type: json
        data: '{}'
    docs: Generate a new security report.
  - info:
      name: Delete Report
      type: http
    http:
      method: DELETE
      url: https://{platformHostname}/connect/api/v1/reports/:reportId
      params:
      - name: reportId
        value: ''
        type: path
        description: Unique identifier for the report
    docs: Delete a security report.
- info:
    name: Playbooks
    type: folder
  items:
  - info:
      name: List Playbooks
      type: http
    http:
      method: GET
      url: https://{platformHostname}/connect/api/v1/playbooks
    docs: Retrieve all ATH Playbook response action definitions.
  - info:
      name: Create Playbook
      type: http
    http:
      method: POST
      url: https://{platformHostname}/connect/api/v1/playbooks
      body:
        type: json
        data: '{}'
    docs: Create a new ATH Playbook response action.
bundled: true
Stellar Cyber

APIs

Stellar Cyber Open XDR API

Collections

Stellar Cyber Open XDR API

Pricing Plans

Stellar Cyber Plans Pricing

Rate Limits

Stellar Cyber Rate Limits

FinOps

Stellar Cyber Finops

Semantic Vocabularies

Stellar Cyber Context

API Governance Rules

Stellar Cyber API Rules

JSON Structure

Stellar Cyber Case Structure

Example Payloads

Stellar Cyber Create Case Example

Stellar Cyber List Cases Example

Resources

Sources
