Summary:
\nRisks and mitigations:
\n- \n(Example: The ALPHV\nmalware is known to use vulnerabilities in support ticket systems\nto gain access to networks. These systems should be kept up to date\nand their access heavily restricted.)\n\n
- a single taxonomy node, or \n
- all taxonomy nodes in a taxonomy node path. \n
- The taxonomy node name as a string. E.g., `\"this is a name\"`. \n
- A `TaxonomyNodeAPISchema` object. \n
- A list of taxonomy node names.\nThe first string in the list must be the name of a root node.\n
\nFor example:[\"root node name\", \"parent node name\", \"child node name\"]
\n \n - A list of taxonomy node URLs.\nTo refer to a node by URL, it must already exist.\n
\nFor example:[\n \"https://
\n/api/ /taxonomies/4\",\n \"https:// /api/ /taxonomies/9\"\n] \n - A list of taxonomy node IDs.\nTo refer to a node by ID, it must already exist.\n
\nFor example:[4, 9]
\n \n - A list of `TaxonomyNodeAPISchema` objects.\nIf you specify an ID for a node,\nit must already exist.\n
\nFor example:[\n {\n \"id\": 4,\n \"name\": \"a parent node name\",\n \"description\": \"a description\"\n },\n {\n \"id\": 9,\n \"name\": \"a child node name\",\n \"description\": \"a description\"\n }\n]\n \n - A mix of types.\n
\nFor example:[\n 4,\n \"https://
\n/api/ /taxonomies/9\",\n {\n \"name\": \"a child node name\",\n \"description\": \"a description\"\n }\n] \n - \nA root node:\nA root node is a top-level taxonomy node that has no parent nodes.\n \n
- \nAn existing parent node:\nYou must specify an existing parent node\nby ID, URL, or as a `TaxonomyNodeAPISchema` object\nwith a specific `\"id\"`.\n \n
MITRE ATT&CK Techniques:
\n- \n(Example: Defense Evasion: Modify Registry (T1112)Lateral Movement:\nLateral Tool Transfer (T1570)) (If no ATT&CK techniques are available,\njust say \"Unknown\")\n\n
Indicators
\nType: Value\nType: Value\nType: Value\n \n```\n","type":"string"},"custom_summary_content_instruction":{"description":"\nWhen the `report_type` is custom, you must provide the instruction.\nElse you must not provide it.\n\nExample:\n\n```\nYou must summarise the intelligence entity data delimited by triple commas into a single\nreport written for a strategic audience such as a CISO or other non-technical decision\nmaker.\n\nProvide four to five paragraphs summarising the provided intelligence information. Do\nnot list or describe the quantities of the entities. The report must focus on describing\nthe overall picture from the data, including a summary of the risk and possible\nmitigations.\n\nIf any of the provided entities include MITRE ATT&CK techniques or indicators of\ncompromise, or vulnerabilities, list these after the summary.\n\nAssume that all the entities provided to you are related to each other. For example if\nyou are provided with a threat actor and a malware, assume that the malware is used by\nthat threat actor. If a threat actor or malware has metadata including industry tags,\nassume that actor or malware targets that industry. If a malware is provided with one or\nmore vulnerabilities, assume that the malware exploits those vulnerabilities.\n\nIf threat report entities are provided, they may provide additional similar insights.\n\nWhen summarising entities, be concise. As an example, if a report describes a threat\nactor, summarise the malware and tools they use, their victims, the vulnerabilities they\nexploit, and recent activity.\n\nOnly use intelligence information provided when summarising, do not add new information.\nDo not make overly generic statements such as \"implement better security\", use specifics\nif available.\n\nIf you are not provided with sufficient data to summarise, briefly summarise the\navailable data as a single paragraph and any lists of IOCs or ATT&CK techniques, and\ncomment that further investigation is required. For example if a threat actor entity is\nprovided but has no description, comment that further research is required.\n```\n","type":"string"},"entities":{"description":"The entity ids to summarize in the report.","example":["http://localhost/api/v2/entities/b39be349-76fd-4d9c-bb65-5c51bd0b4566"],"items":{"description":"Entity ID/URL","example":"http://localhost/api/v2/entities/b39be349-76fd-4d9c-bb65-5c51bd0b4566"},"maxItems":10,"minItems":1,"type":"array"},"observables":{"description":"The observable ids to summarize in the report.","example":["http://localhost/api/v2/observables/1"],"items":{"description":"Observable ID/URL","example":"http://localhost/api/v2/observables/1"},"maxItems":20,"minItems":0,"type":"array"},"report_title":{"description":"Define manually the report title instead of using the one generated by the AI.","type":"string"},"summary_type":{"enum":["strategic","technical","custom"],"type":"string"}},"required":["entities","summary_type"],"type":"object"},"EntityRuleAPISchema":{"properties":{"actions":{"description":"List of actions that the rule should perform on each entity. Supported: ['add_tags', 'add_to_set', 'override_tlp', 'set_alias', 'convert_to_eiqjson2', 'remove_tags']","enum":["add_tags","add_to_set","override_tlp","set_alias","convert_to_eiqjson2","remove_tags"],"items":{"type":"string"},"type":"array"},"add_tags":{"description":"List of tags that should be added to the matched entities if `add_tags` is included in the list of actions","items":{"type":"string"},"type":"array"},"add_taxonomies":{"description":"List of taxonomies that should be added to the matched entities if `add_tags` is included in the list of actions","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"},"alias_formatting_template":{"description":"Template to be applied to the entity meta.alias field, e.g. `malware={malware}, url={url}, ip={ip}`","nullable":true,"type":"string"},"content_criteria":{"nullable":true},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"datasets":{"description":"List of the datasets associated to this rule","example":["http://localhost/api/v2/datasets/1"],"items":{"description":"Dataset ID/URL","example":"http://localhost/api/v2/datasets/1"},"type":"array"},"description":{"nullable":true,"type":"string"},"eiqjson2_entity_type":{"description":"Target type for `convert_to_eiqjson2` action. Supported: ('attack-pattern', 'identity', 'infrastructure', 'intrusion-set', 'malware', 'malware-family', 'tool')","enum":["attack-pattern","identity","infrastructure","intrusion-set","malware","malware-family","tool",null],"nullable":true,"type":"string"},"entity_types":{"description":"Types of entities matched by the rule","items":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"},"type":"array"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"master_entity":{"description":"URL of the rule master entity","example":"http://localhost/api/v2/entities/ff4f1956-76af-44b6-9713-8635b3f55020","nullable":true},"name":{"type":"string"},"override_tlp":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"remove_tags":{"description":"List of tags that should be removed from the matched entities if `remove_tags` is included in the list of actions","items":{"type":"string"},"type":"array"},"remove_taxonomies":{"description":"List of taxonomies that should be removed from the matched entities if `remove_tags` is included in the list of actions","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"},"sources":{"description":"List of sources matched by the rule","example":["http://localhost/api/v2/sources/78063112-fe91-4db8-ac0a-58b6e095d75a"],"items":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/78063112-fe91-4db8-ac0a-58b6e095d75a"},"type":"array"},"status":{"description":"Status of the latest rule task execution","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS",null],"nullable":true,"readOnly":true,"type":"string"},"task":{"description":"Task associated to this rule","example":"http://localhost/api/v2/tasks/1","readOnly":true},"tlps":{"description":"List of TLPs that the rule should match","items":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"type":"array"}},"required":["actions","is_active","name"],"type":"object"},"EntitySummaryGenerationResponseSchema":{"properties":{"description":{"type":"string"},"title":{"type":"string"}},"type":"object"},"EntityWebEnrichmentOutputSchema":{"properties":{"description":{"items":{"type":"string"},"type":"array"},"key_highlights":{"items":{"$ref":"#/components/schemas/KeyHighlightSchema"},"type":"array"},"related_entities":{"items":{"$ref":"#/components/schemas/RelatedEntitySchema"},"type":"array"},"sources":{"items":{"$ref":"#/components/schemas/WebEnrichmentSourceSchema"},"type":"array"},"title":{"type":"string"}},"type":"object"},"EntityWebEnrichmentRefinementResponseSchema":{"properties":{"refinement_output":{"type":"string"}},"type":"object"},"EntityWebEnrichmentRefinementSchema":{"properties":{"chat_history":{"description":"Chat history for enrichment refinement.","items":{"$ref":"#/components/schemas/ChatHistoryItemSchema1"},"type":"array"},"enrichment_output":{"$ref":"#/components/schemas/EntityWebEnrichmentOutputSchema"},"user_query":{"type":"string"}},"required":["chat_history","enrichment_output","user_query"],"type":"object"},"EntityWebEnrichmentResponseSchema":{"properties":{"description":{"items":{"type":"string"},"type":"array"},"key_highlights":{"items":{"$ref":"#/components/schemas/KeyHighlightSchema"},"type":"array"},"related_entities":{"items":{"$ref":"#/components/schemas/RelatedEntitySchema"},"type":"array"},"sources":{"items":{"$ref":"#/components/schemas/WebEnrichmentSourceSchema"},"type":"array"},"title":{"type":"string"}},"type":"object"},"EntityWebEnrichmentSchema":{"properties":{"entity":{"description":"The entity id to enrich.","example":"http://localhost/api/v2/entities/beb29516-77de-412f-a784-f02743794023"}},"required":["entity"],"type":"object"},"ExploitTargetDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"configurations":{"items":{"$ref":"#/components/schemas/ConfigurationSchema"},"type":"array"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceAPISchema"},"short_description":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"},"vulnerabilities":{"items":{"$ref":"#/components/schemas/VulnerabilitiesSchema"},"type":"array"},"weaknesses":{"items":{"$ref":"#/components/schemas/WeaknessSchema"},"type":"array"}},"required":["title","type"],"type":"object"},"ExportBlockSchema":{"properties":{"content_type":{"type":"string"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"filename":{"readOnly":true,"type":"string"},"id":{"type":"integer"},"run_id":{"readOnly":true,"type":"string"},"size":{"readOnly":true,"type":"integer"}},"required":["content_type"],"type":"object"},"ExternalReferenceSchema":{"properties":{"description":{"type":"string"},"external_id":{"type":"string"},"hashes":{"additionalProperties":{"type":"string"},"type":"object"},"source_name":{"type":"string"},"url":{"type":"string"}},"required":["source_name"],"type":"object"},"ExtractCsvSchema":{"properties":{"include_fields":{"items":{"type":"string"},"type":"array"}},"type":"object"},"FeatureFlagSchema":{"properties":{"inactive_entities_enabled":{"default":false,"type":"boolean"},"is_terminology_customization_enabled":{"default":false,"type":"boolean"},"property_propagation":{"default":false,"type":"boolean"}},"type":"object"},"FeedAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"last_triggered_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"status":{"description":"Status of the latest feed run","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"readOnly":true,"type":"string"},"tlp_color_override":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"transport_access_details":{"readOnly":true,"type":"string"}},"required":["name"],"type":"object"},"FileAPISchema":{"properties":{"content_type":{"default":"application/octet-stream","description":"MIME type or platform content type for this file","example":"application/octet-stream","type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"URL of the user that created this workspace","example":"http://localhost/api/v2/users/1","readOnly":true},"data":{"description":"Base64-encoded representation of the file content. If the content type is associated to structured intelligence on the platform then any entities and observables included in the file will be processed by the platform.","example":"hSRyRN1chKKWPA==\n"},"download_url":{"description":"Download link for the file","format":"url","readOnly":true,"type":"string"},"filename":{"type":"string"},"hash":{"description":"File content hash (it must be unique for each workspace)","readOnly":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"is_public":{"description":"Public files in public workspaces can be accessed by any user with `read files` permissions","type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"size":{"description":"File size in bytes","readOnly":true,"type":"integer"},"workspace":{"description":"Workspace ID/URL","example":"http://localhost/api/v2/workspaces/1"}},"required":["data","filename","hash"],"type":"object"},"FilteringCriteriaSchema":{"properties":{"entity_types":{"description":"Types of entities matched by the rule","items":{"enum":["malware","threat-actor","report"],"type":"string"},"type":"array"},"sources":{"description":"List of sources matched by the rule","example":["http://localhost/api/v2/sources/36eeecc3-5328-4171-ad1e-9fd86e6898b2"],"items":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/36eeecc3-5328-4171-ad1e-9fd86e6898b2"},"type":"array"},"tags":{"description":"List of tags that the rule should match","items":{"type":"string"},"type":"array"},"taxonomies":{"description":"List of taxonomies that the rule should match","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"},"tlps":{"description":"List of TLPs that the rule should match","items":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"type":"array"}},"type":"object"},"FilteringCriteriaSchema1":{"properties":{"content_criteria":{"nullable":true},"entity_types":{"description":"Types of entities matched by the rule","items":{"enum":["identity","observable-wrapper","infrastructure","location","course-of-action","intrusion-set","eclecticiq-sighting","campaign","note","malware-analysis","custom-entity","exploit-target","indicator","package","report","tool","threat-actor","incident","malware","ttp","attack-pattern"],"type":"string"},"minItems":1,"type":"array"},"related_entity_sources":{"description":"List of sources matched by the related entity","example":["http://localhost/api/v2/sources/fcad1414-30b9-40ee-99f2-64c5308b9690"],"items":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/fcad1414-30b9-40ee-99f2-64c5308b9690"},"type":"array"},"related_entity_tlps":{"description":"List of TLPs that the related entity should match","items":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"type":"array"},"related_entity_types":{"description":"Types of related entities matched by the rule","items":{"enum":["identity","observable-wrapper","infrastructure","location","course-of-action","intrusion-set","eclecticiq-sighting","campaign","note","malware-analysis","custom-entity","exploit-target","indicator","package","report","tool","threat-actor","incident","malware","ttp","attack-pattern"],"type":"string"},"minItems":1,"type":"array"},"related_observable_types":{"description":"Types of observable types for getting related entities","items":{"enum":["ja3-full","hash-md5","ipv4-cidr","certificate-hash","malware-key","hash-sha384","inetnum","cwe","ipv4","hash-sha224","snort","certificate-serial-number","account-id","handle","certificate-subject","user-agent","person","hash-imphash","process","country","street","name","mutex","container-image-name","certificate-issuer","card","ipv6","organization","host","hash-ssdeep","city","cpu-architecture","uri-hash-sha256","bank-account","domain","ja3s-hash","card-owner","process-name","address","netname","email-subject","jarm","hash-rich-pe-header","geo-long","asn","registrar","email","product","forum-room","ja3-hash","rule","container-registry-account-name","country-code","file","yara","port","industry","forum-thread","winregistry","user-account","region","telephone","hash-vhash","container-cluster-name","device-fingerprint","hash-authentihash","hash-sha256","cloud-storage-bucket","cce","ipv6-cidr","ssh-public-key","nationality","eui-64","ja3s-full","cve","actor-id","geo-lat","hash-sha512","postcode","company","forum-name","geo","hash-sha1","mac-48","file-size","fox-it-portal-uri","uri","malware","crypto-address"],"type":"string"},"type":"array"},"related_through_entities_entity_types":{"description":"Filter for related through entities","items":{"enum":["identity","observable-wrapper","infrastructure","location","course-of-action","intrusion-set","eclecticiq-sighting","campaign","note","malware-analysis","custom-entity","exploit-target","indicator","package","report","tool","threat-actor","incident","malware","ttp","attack-pattern"],"type":"string"},"type":"array"},"sources":{"description":"List of sources matched by the rule","example":["http://localhost/api/v2/sources/90c2ed53-78fa-4bbd-97a3-e100be39d351"],"items":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/90c2ed53-78fa-4bbd-97a3-e100be39d351"},"type":"array"},"tags":{"description":"List of tags that the rule should match","items":{"type":"string"},"type":"array"},"taxonomies":{"description":"List of taxonomies that the rule should match","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"},"tlps":{"description":"List of TLPs that the rule should match","items":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"type":"array"}},"type":"object"},"FontFamilySchema":{"properties":{"category":{"readOnly":true,"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"fonts":{"items":{"$ref":"#/components/schemas/FontSchema"},"type":"array"},"id":{"readOnly":true,"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"readOnly":true,"type":"string"}},"type":"object"},"FontSchema":{"properties":{"data":{"type":"string","writeOnly":true},"id":{"readOnly":true,"type":"integer"},"name":{"readOnly":true,"type":"string"},"style":{"readOnly":true,"type":"string"},"url":{"readOnly":true},"weight":{"readOnly":true,"type":"string"}},"type":"object"},"GenericTestMechanismTypeSchema":{"properties":{"description":{"type":"string"},"efficacy":{"$ref":"#/components/schemas/TestMechanismEfficacySchema"},"generic_test_mechanism_type":{"enum":["pcre","sigma","stix","suricata"],"type":"string"},"producer":{"$ref":"#/components/schemas/ProducerSchema"},"specification":{"$ref":"#/components/schemas/ValueSchema"},"test_mechanism_type":{"enum":["generic","snort","yara"],"type":"string"},"type":{"default":"test-mechanism","description":"Constant field, must have a value of \"test-mechanism\"","type":"string"}},"required":["generic_test_mechanism_type","test_mechanism_type"],"type":"object"},"GenericVocabSchema":{"properties":{"value":{"type":"string"},"vocab":{"type":"string"}},"required":["value"],"type":"object"},"GroupAPISchema":{"properties":{"created_at":{"description":"User group creation date (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"type":"string"},"id":{"description":"Group ID","readOnly":true,"type":"integer"},"last_updated_at":{"description":"User group last update date (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"description":"Group name","example":"admin","type":"string"},"sources":{"description":"List of sources this group is allowed to access. Possible TLP values: ('NONE', 'WHITE', 'CLEAR', 'GREEN', 'AMBER', 'AMBER_STRICT', 'RED')","example":["http://localhost/api/v2/sources/c2e100ba-4aa5-442a-b041-b71407b09421?allowed_tlp=RED"],"items":{"description":"Allowed source with (optional) TLP color filter","example":"http://localhost/api/v2/sources/c2e100ba-4aa5-442a-b041-b71407b09421?allowed_tlp=RED"},"type":"array"},"users":{"description":"List of users associated to this group. This is only visible if you have the \"read users\" permission or if you are an administrator of the group.","example":["http://localhost/api/v2/users/1?role=member"],"items":{"description":"User ID/URL associated to a group,together with its role. Possible values: ('member', 'admin'))","example":"http://localhost/api/v2/users/1?role=member","readOnly":true},"readOnly":true,"type":"array"}},"required":["id","name"],"type":"object"},"HeaderFooterSectionSchema":{"properties":{"id":{"type":"integer"},"meta":{"type":"object"},"position":{"enum":["left","center","right"],"type":"string"},"type":{"enum":["do_not_display","date","page_no","tlp","image"],"type":"string"},"value":{"nullable":true,"type":"string"}},"required":["id"],"type":"object"},"IdentityClassVocabSchema":{"properties":{"value":{"enum":["individual","group","system","organization","class","unknown"],"type":"string"},"vocab":{"default":"identity-class-ov","description":"Constant field, must have a value of \"identity-class-ov\"","type":"string"}},"required":["value"],"type":"object"},"IdentitySchema":{"properties":{"id":{"type":"string"},"idref":{"type":"string"},"name":{"type":"string"},"type":{"default":"identity","description":"Constant field, must have a value of \"identity\"","type":"string"}},"required":["type"],"type":"object"},"IdentitySchema1":{"properties":{"identity_type":{"default":"ciq","description":"Constant field, must have a value of \"ciq\"","type":"string"},"name":{"nullable":true,"type":"string"},"specification_xml":{"type":"string"},"specification_xml_type":{"default":"{http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1}STIXCIQIdentity3.0Type","description":"Constant field, must have a value of \"{http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1}STIXCIQIdentity3.0Type\"","type":"string"},"type":{"default":"identity","description":"Constant field, must have a value of \"identity\"","type":"string"}},"type":"object"},"ImpactAssessmentEffectsSchema":{"properties":{"value":{"enum":["Brand or Image Degradation","Data Breach or Compromise","Degradation of Service","Destruction","Disruption of Service / Operations","Financial Loss","Loss of Competitive Advantage","Loss of Competitive Advantage - Economic","Loss of Competitive Advantage - Military","Loss of Competitive Advantage - Political","Loss of Confidential / Proprietary Information or Intellectual Property","Regulatory, Compliance or Legal Impact","Unintended Access","User Data Loss"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}IncidentEffectVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}IncidentEffectVocab-1.0\"","type":"string"}},"type":"object"},"ImpactAssessmentSchema":{"properties":{"direct_impact_summary_asset_losses":{"enum":["Major","Minor","Moderate","None"],"type":"string"},"direct_impact_summary_business_mission_disruption":{"enum":["Major","Minor","Moderate","None"],"type":"string"},"direct_impact_summary_response_and_recovery_costs":{"enum":["Major","Minor","Moderate","None"],"type":"string"},"effects":{"items":{"$ref":"#/components/schemas/ImpactAssessmentEffectsSchema"},"type":"array"},"impact_qualification":{"enum":["Insignificant","Distracting","Painful","Damaging","Catastrophic","Unknown"],"type":"string"},"indirect_impact_summary_brand_and_market_damage":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"indirect_impact_summary_increased_operating_costs":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"indirect_impact_summary_legal_and_regulatory_costs":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"indirect_impact_summary_loss_of_competitive_advantage":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"total_loss_estimation_actual_amount":{"type":"string"},"total_loss_estimation_actual_iso_currency_code":{"type":"string"},"total_loss_estimation_initial_reported_amount":{"type":"string"},"total_loss_estimation_initial_reported_iso_currency_code":{"type":"string"},"type":{"default":"impact-assessment","description":"Constant field, must have a value of \"impact-assessment\"","type":"string"}},"type":"object"},"ImpactOrCostOrEfficacySchema":{"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"description":{"type":"string"},"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["High","Low","Medium","None","Unknown"],"type":"string"}},"required":["value"],"type":"object"},"ImplementationLanguageVocabSchema":{"properties":{"value":{"enum":["applescript","bash","c","c++","c#","go","java","javascript","lua","objective-c","perl","php","powershell","python","ruby","scala","swift","typescript","visual-basic","x86-32","x86-64"],"type":"string"},"vocab":{"default":"implementation-language-ov","description":"Constant field, must have a value of \"implementation-language-ov\"","type":"string"}},"required":["value"],"type":"object"},"IncidentCategoriesSchema":{"properties":{"value":{"enum":["Denial of Service","Exercise/Network Defense Testing","Improper Usage","Investigation","Malicious Code","Scans/Probes/Attempted Access","Unauthorized Access"],"type":"string"}},"required":["value"],"type":"object"},"IncidentDataSchema":{"additionalProperties":true,"properties":{"affected_assets":{"items":{"$ref":"#/components/schemas/AffectedAssetsSchema"},"type":"array"},"categories":{"items":{"$ref":"#/components/schemas/IncidentCategoriesSchema"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"contacts":{"items":{"$ref":"#/components/schemas/IncidentInformationSourceSchema"},"type":"array"},"coordinators":{"items":{"$ref":"#/components/schemas/IncidentInformationSourceSchema"},"type":"array"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"discovery_methods":{"items":{"$ref":"#/components/schemas/IncidentDiscoveryMethods"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"impact_assessment":{"$ref":"#/components/schemas/ImpactAssessmentSchema"},"information_source":{"$ref":"#/components/schemas/InformationSourceAPISchema"},"intended_effects":{"items":{"$ref":"#/components/schemas/IntendedEffectSchema"},"type":"array"},"reporter":{"$ref":"#/components/schemas/IncidentInformationSourceSchema"},"responders":{"items":{"$ref":"#/components/schemas/IncidentInformationSourceSchema"},"type":"array"},"security_compromise":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"short_description":{"type":"string"},"status":{"enum":["Closed","Containment Achieved","Deleted","Incident Reported","New","Open","Rejected","Restoration Achieved","Stalled"],"type":"string"},"time_containment_achieved":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_containment_achieved_precision":{"type":"string"},"time_first_data_exfiltration":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_first_data_exfiltration_precision":{"type":"string"},"time_first_malicious_action":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_first_malicious_action_precision":{"type":"string"},"time_incident_closed":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_incident_closed_precision":{"type":"string"},"time_incident_discovery":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_incident_discovery_precision":{"type":"string"},"time_incident_opened":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_incident_opened_precision":{"type":"string"},"time_incident_reported":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_incident_reported_precision":{"type":"string"},"time_initial_compromise":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_initial_compromise_precision":{"type":"string"},"time_restoration_achieved":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_restoration_achieved_precision":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"},"victims":{"items":{"$ref":"#/components/schemas/IdentitySchema1"},"type":"array"}},"required":["title","type"],"type":"object"},"IncidentDiscoveryMethods":{"properties":{"value":{"enum":["Agent Disclosure","Antivirus","Audit","Customer","Financial Audit","Fraud Detection","HIPS","IT Audit","Incident Response","Law Enforcement","Log Review","Monitoring Service","NIDS","Security Alarm","Unknown","Unrelated Party","User"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}DiscoveryMethodVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}DiscoveryMethodVocab-1.0\"","type":"string"}},"type":"object"},"IncidentInformationSourceRolesSchema":{"properties":{"value":{"enum":["Aggregator","Content Enhancer/Refiner","Initial Author","Transformer/Translator"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0\"","type":"string"}},"type":"object"},"IncidentInformationSourceSchema":{"properties":{"description":{"type":"string"},"identity":{"$ref":"#/components/schemas/IdentitySchema1"},"roles":{"items":{"$ref":"#/components/schemas/IncidentInformationSourceRolesSchema"},"minItems":1,"type":"array"},"type":{"default":"information-source","description":"Constant field, must have a value of \"information-source\"","type":"string"}},"required":["roles"],"type":"object"},"IncomingFeedAPISchema":{"properties":{"archive_password":{"default":null,"nullable":true,"type":"string"},"content_type":{"enum":["urn:spycloud.io:json:1.0","urn:spycloud.io:data-json:1.0","urn:eclecticiq.com:advanced-csv-entities:1.0"],"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"execution_schedule":{"allOf":[{"$ref":"#/components/schemas/TaskExecutionScheduleSchema"}],"nullable":true},"half_life":{"type":"object"},"id":{"readOnly":true,"type":"integer"},"is_being_purged":{"readOnly":true,"type":"boolean"},"last_triggered_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"n_blobs_error":{"readOnly":true,"type":"integer"},"n_blobs_pending":{"readOnly":true,"type":"integer"},"n_blobs_success":{"readOnly":true,"type":"integer"},"n_ingested_entities":{"readOnly":true,"type":"integer"},"name":{"type":"string"},"organisation":{"nullable":true,"type":"string"},"require_content_validation":{"type":"boolean"},"require_link_types":{"type":"boolean"},"require_valid_signature":{"type":"boolean"},"source":{"description":"Source associated to this feed","example":"http://localhost/api/v2/sources/25e5cebc-6cd5-4b0f-a485-5aa96ee86c90","readOnly":true},"status":{"description":"Status of the latest feed run","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"readOnly":true,"type":"string"},"task":{"description":"Task associated to this feed","example":"http://localhost/api/v2/tasks/1","readOnly":true},"tlp_color_override":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"transport_access_details":{"readOnly":true,"type":"string"},"transport_configuration":{"description":"Configuration specific for the selected feed transport","nullable":true},"transport_error":{"readOnly":true},"transport_type":{"enum":["eiq.incoming-transports.spycloud","eiq.incoming-transports.fetch_spycloud_data","eiq.incoming-transports.advanced_csv_provider"],"type":"string"}},"required":["content_type","name","transport_configuration","transport_type"],"type":"object"},"IndicatorDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"likely_impact":{"$ref":"#/components/schemas/IndicatorLikelyImpactSchema"},"producer":{"$ref":"#/components/schemas/InformationSourceAPISchema"},"short_description":{"type":"string"},"sightings_count":{"minimum":0,"type":"integer"},"test_mechanisms":{"description":"If no \"Test mechanism\" is populated, and if this indicator isn't linked to an observable that is included or allowed when creating an outgoing feed, this indicator won't have a \"Pattern\", and will be skipped when exporting in STIX 2.1 format.","items":{"description":"This object will be validated with a schema selected based on the value of the \"test_mechanism_type\" property.","discriminator":{"mapping":{"generic":"#/components/schemas/GenericTestMechanismTypeSchema","snort":"#/components/schemas/SnortTestMechanismTypeSchema","yara":"#/components/schemas/YaraTestMechanismTypeSchema"},"propertyName":"test_mechanism_type"},"oneOf":[{"$ref":"#/components/schemas/SnortTestMechanismTypeSchema"},{"$ref":"#/components/schemas/YaraTestMechanismTypeSchema"},{"$ref":"#/components/schemas/GenericTestMechanismTypeSchema"}],"properties":{"test_mechanism_type":{"enum":["snort","yara","generic"],"type":"string"}},"required":["test_mechanism_type"],"type":"object"},"type":"array"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"},"types":{"items":{"$ref":"#/components/schemas/IndicatorTypesSchema"},"type":"array"},"valid_time_positions":{"items":{"$ref":"#/components/schemas/TimeWindowSchema"},"type":"array"}},"required":["title","type"],"type":"object"},"IndicatorLikelyImpactSchema":{"properties":{"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["High","Low","Medium","None","Unknown"],"type":"string"}},"type":"object"},"IndicatorTypesSchema":{"properties":{"value":{"enum":["Anonymization","C2","Compromised PKI Certificate","Domain Watchlist","Exfiltration","File Hash Watchlist","Host Characteristics","IMEI Watchlist","IMSI Watchlist","IP Watchlist","Login Name","Malicious E-mail","Malware Artifacts","URL Watchlist"],"type":"string"}},"type":"object"},"IndustrySectorVocabSchema":{"properties":{"value":{"enum":["agriculture","aerospace","automotive","chemical","commercial","communications","construction","defense","education","energy","entertainment","financial-services","government","emergency-services","government-local","government-national","government-public-services","government-regional","healthcare","hospitality-leisure","infrastructure","dams","nuclear","water","insurance","manufacturing","mining","non-profit","pharmaceuticals","retail","technology","telecommunications","transportation","utilities"],"type":"string"},"vocab":{"default":"industry-sector-ov","description":"Constant field, must have a value of \"industry-sector-ov\"","type":"string"}},"required":["value"],"type":"object"},"InformationSourceAPISchema":{"properties":{"description":{"type":"string"},"identity":{"$ref":"#/components/schemas/InformationSourceIdentitySchema"},"references":{"items":{"format":"url","type":"string"},"type":"array"},"roles":{"items":{"$ref":"#/components/schemas/RolesSchema"},"type":"array"},"type":{"default":"information-source","description":"Constant field, must have a value of \"information-source\"","type":"string"}},"type":"object"},"InformationSourceIdentitySchema":{"properties":{"name":{"type":"string"},"type":{"default":"identity","description":"Constant field, must have a value of \"identity\"","type":"string"}},"type":"object"},"InformationSourceRoleVocabSchema":{"properties":{"value":{"enum":["Initial Author","Content Enhancer/Refiner","Aggregator","Transformer/Translator"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"InformationSourceSchema":{"properties":{"description":{"type":"string"},"description_structuring_format":{"type":"string"},"identity":{"$ref":"#/components/schemas/IdentitySchema"},"references":{"items":{"type":"string"},"type":"array"},"roles":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ControlledVocabularyStringSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ControlledVocabularyStringSchema","{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0":"#/components/schemas/InformationSourceRoleVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/InformationSourceRoleVocabSchema"},{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"time_end":{"format":"date-time","nullable":true,"type":"string"},"time_produced":{"format":"date-time","nullable":true,"type":"string"},"time_received":{"format":"date-time","nullable":true,"type":"string"},"time_start":{"format":"date-time","nullable":true,"type":"string"},"tools":{"items":{"$ref":"#/components/schemas/ToolInformationSchema"},"type":"array"},"type":{"default":"information-source","description":"Constant field, must have a value of \"information-source\"","type":"string"}},"required":["type"],"type":"object"},"InformationTypeVocabSchema":{"properties":{"value":{"enum":["Information Assets","Information Assets - Corporate Employee Information","Information Assets - Customer PII","Information Assets - Email Lists / Archives","Information Assets - Financial Data","Information Assets - Intellectual Property","Information Assets - Mobile Phone Contacts","Information Assets - User Credentials","Authentication Cookies"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}InformationTypeVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}InformationTypeVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"InfrastructureTypeVocabSchema":{"properties":{"value":{"enum":["amplification","anonymization","botnet","command-and-control","control-system","exfiltration","firewall","hosting-malware","hosting-target-lists","phishing","reconnaissance","routers-switches","staging","workstation","unknown"],"type":"string"},"vocab":{"default":"infrastructure-type-ov","description":"Constant field, must have a value of \"infrastructure-type-ov\"","type":"string"}},"required":["value"],"type":"object"},"IntelRequirementAPISchema":{"properties":{"actions":{"$ref":"#/components/schemas/ActionSchema"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"custom_id":{"type":"string"},"description":{"nullable":true,"type":"string"},"filtering_criteria":{"$ref":"#/components/schemas/FilteringCriteriaSchema"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"matching_criteria":{"$ref":"#/components/schemas/MatchingCriteriaSchema"},"matching_method":{"enum":["keyword-based","ai-based"],"type":"string"},"name":{"type":"string"},"notification_settings":{"$ref":"#/components/schemas/NotificationSettingsSchema"},"owner":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"priority":{"type":"string"},"task":{"description":"Task associated to this rule","example":"http://localhost/api/v2/tasks/1","readOnly":true},"watcher_groups":{"description":"[Collection of] Group ID/URL","example":["http://localhost/api/v2/groups/1"],"items":{"description":"Group ID/URL","example":"http://localhost/api/v2/groups/1"},"type":"array"},"watchers":{"description":"[Collection of] User ID/URL","example":["http://localhost/api/v2/users/1"],"items":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"type":"array"}},"required":["actions","custom_id","filtering_criteria","is_active","matching_method","name","priority"],"type":"object"},"IntelRequirementMatchAPISchema":{"properties":{"accuracy":{"enum":["None","Low","Medium","High"],"readOnly":true,"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"entity_id":{"description":"Entity ID/URL","example":"http://localhost/api/v2/entities/b9fd19c3-e2ea-4b3b-bc08-ee8162cd9021"},"id":{"readOnly":true,"type":"integer"},"intel_requirement_id":{"description":"IntelRequirement ID/URL","example":"http://localhost/api/v2/intel-requirement/1"},"matching_method":{"enum":["keyword-based","ai-based","user-assigned"],"type":"string"},"reason":{"items":{"$ref":"#/components/schemas/ReasonSchema"},"type":"array"}},"required":["entity_id","intel_requirement_id","matching_method"],"type":"object"},"IntendedEffectSchema":{"properties":{"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["Account Takeover","Advantage","Advantage - Economic","Advantage - Military","Advantage - Political","Brand Damage","Competitive Advantage","Degradation of Service","Denial and Deception","Destruction","Disruption","Embarrassment","Exposure","Extortion","Fraud","Harassment","ICS Control","Theft","Theft - Credential Theft","Theft - Identity Theft","Theft - Intellectual Property","Theft - Theft of Proprietary Information","Traffic Diversion","Unauthorized Access"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"IntendedEffectStatementSchema":{"properties":{"confidence":{"description":"This object will be validated with a schema selected based on the value of the \"value_vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ConfidenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ConfidenceSchema","{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0":"#/components/schemas/ConfidenceHighMediumLowVocabSchema"},"propertyName":"value_vocab"},"oneOf":[{"$ref":"#/components/schemas/ConfidenceHighMediumLowVocabSchema"},{"$ref":"#/components/schemas/ConfidenceSchema"}],"properties":{"value_vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0","*"],"type":"string"}},"type":"object"},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"type":"string"},"idref":{"type":"string"},"timestamp":{"format":"date-time","nullable":true,"type":"string"},"timestamp_precision":{"enum":["year","month","day","hour","minute","second"],"type":"string"},"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["Advantage","Advantage - Economic","Advantage - Military","Advantage - Political","Theft","Theft - Intellectual Property","Theft - Credential Theft","Theft - Identity Theft","Theft - Theft of Proprietary Information","Account Takeover","Brand Damage","Competitive Advantage","Degradation of Service","Denial and Deception","Destruction","Disruption","Embarrassment","Exposure","Extortion","Fraud","Harassment","ICS Control","Traffic Diversion","Unauthorized Access"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0\"","type":"string"}},"required":["type","value"],"type":"object"},"IntendedEffectVocabSchema":{"properties":{"value":{"enum":["Advantage","Advantage - Economic","Advantage - Military","Advantage - Political","Theft","Theft - Intellectual Property","Theft - Credential Theft","Theft - Identity Theft","Theft - Theft of Proprietary Information","Account Takeover","Brand Damage","Competitive Advantage","Degradation of Service","Denial and Deception","Destruction","Disruption","Embarrassment","Exposure","Extortion","Fraud","Harassment","ICS Control","Traffic Diversion","Unauthorized Access"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"JSONIDsSchema":{"properties":{"data":{"example":["id"],"items":{"type":"string"},"type":"array"}},"type":"object"},"JSONIntIDsSchema":{"properties":{"data":{"example":[1],"items":{"type":"integer"},"type":"array"}},"type":"object"},"KeyHighlightSchema":{"properties":{"date":{"type":"string"},"highlight":{"type":"string"},"source_ids":{"items":{"type":"string"},"type":"array"}},"type":"object"},"KillChainPhaseReferenceSchema":{"properties":{"kill_chain_id":{"type":"string"},"kill_chain_name":{"type":"string"},"name":{"type":"string"},"ordinality":{"type":"integer"},"phase_id":{"type":"string"},"type":{"default":"kill-chain-phase-reference","description":"Constant field, must have a value of \"kill-chain-phase-reference\"","type":"string"}},"required":["type"],"type":"object"},"KillChainPhaseSchema":{"properties":{"name":{"type":"string"},"ordinality":{"type":"integer"},"phase_id":{"type":"string"},"type":{"default":"kill-chain-phase","description":"Constant field, must have a value of \"kill-chain-phase\"","type":"string"}},"required":["type"],"type":"object"},"KillChainSchema":{"properties":{"definer":{"type":"string"},"id":{"type":"string"},"name":{"type":"string"},"number_of_phases":{"type":"integer"},"phases":{"items":{"$ref":"#/components/schemas/KillChainPhaseSchema"},"type":"array"},"reference":{"type":"string"},"type":{"default":"kill-chain","description":"Constant field, must have a value of \"kill-chain\"","type":"string"}},"required":["type"],"type":"object"},"KnowledgePackAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"URL of the user that created this knowledge pack","example":"http://localhost/api/v2/users/1","readOnly":true},"datasets":{"description":"[Collection of] Dataset ID/URL","example":["http://localhost/api/v2/datasets/1"],"items":{"description":"Dataset ID/URL","example":"http://localhost/api/v2/datasets/1"},"type":"array"},"description":{"type":"string"},"id":{"format":"uuid","nullable":true,"type":"string"},"incoming_feeds":{"description":"[Collection of] Incoming feed ID/URL","example":["http://localhost/api/v2/incoming-feeds/1"],"items":{"description":"Incoming feed ID/URL","example":"http://localhost/api/v2/incoming-feeds/1"},"type":"array"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"URL of the user that created this knowledge pack","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"objects_list":{"items":{"$ref":"#/components/schemas/BundleObjectReferenceAPISchema"},"readOnly":true,"type":"array"},"producer":{"description":"Configuration bundle producer ID/URL","example":"http://localhost/api/v2/knowledge-packs-producer/1","readOnly":true},"state":{"enum":["NEW","PUBLISHED","UNINSTALLED","INSTALLED"],"type":"string"},"task":{"description":"Knowledge pack task ID/URL","example":"http://localhost/api/v2/tasks/1"},"workspaces":{"description":"[Collection of] Workspace ID/URL","example":["http://localhost/api/v2/workspaces/1"],"items":{"description":"Workspace ID/URL","example":"http://localhost/api/v2/workspaces/1"},"type":"array"}},"required":["description","name"],"type":"object"},"LuceneQueryGenerationRequestSchema":{"properties":{"question":{"type":"string"}},"required":["question"],"type":"object"},"LuceneQueryGenerationResponseSchema":{"properties":{"lucene_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"}},"required":["lucene_query"],"type":"object"},"MalwareCapabilityVocabSchema":{"properties":{"value":{"enum":["accesses-remote-machines","anti-debugging","anti-disassembly","anti-emulation","anti-memory-forensics","anti-sandbox","anti-vm","captures-input-peripherals","captures-output-peripherals","captures-system-state-data","cleans-traces-of-infection","commits-fraud","communicates-with-c2","compromises-data-availability","compromises-data-integrity","compromises-system-availability","controls-local-machine","degrades-security-software","degrades-system-updates","determines-c2-server","emails-spam","escalates-privileges","evades-av","exfiltrates-data","fingerprints-host","hides-artifacts","hides-executing-code","infects-files","infects-remote-machines","installs-other-components","persists-after-system-reboot","prevents-artifact-access","prevents-artifact-deletion","probes-network-environment","self-modifies","steals-authentication-credentials","violates-system-operational-integrity"],"type":"string"},"vocab":{"default":"malware-capabilities-ov","description":"Constant field, must have a value of \"malware-capabilities-ov\"","type":"string"}},"required":["value"],"type":"object"},"MalwareResultVocabSchema":{"properties":{"value":{"enum":["malicious","suspicious","benign","unknown"],"type":"string"},"vocab":{"default":"malware-result-ov","description":"Constant field, must have a value of \"malware-result-ov\"","type":"string"}},"required":["value"],"type":"object"},"MalwareTypeVocabSchema":{"properties":{"value":{"enum":["adware","backdoor","bot","bootkit","ddos","downloader","dropper","exploit-kit","keylogger","ransomware","remote-access-trojan","resource-exploitation","rogue-security-software","rootkit","screen-capture","spyware","trojan","unknown","virus","webshell","wiper","worm"],"type":"string"},"vocab":{"default":"malware-type-ov","description":"Constant field, must have a value of \"malware-type-ov\"","type":"string"}},"required":["value"],"type":"object"},"MalwareTypeVocabSchema1":{"properties":{"value":{"enum":["Automated Transfer Scripts","Adware","Dialer","Bot","Bot - Credential Theft","Bot - DDoS","Bot - Loader","Bot - Spam","DoS / DDoS","DoS / DDoS - Participatory","DoS / DDoS - Script","DoS / DDoS - Stress Test Tools","Exploit Kits","POS / ATM Malware","Ransomware","Remote Access Trojan","Rogue Antivirus","Rootkit"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}MalwareTypeVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}MalwareTypeVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"MarkingSpecificationSchema":{"properties":{"controlled_structure":{"type":"string"},"id":{"type":"string"},"idref":{"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"marking_structures":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"marking_structure_type\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"MarkingStructureGenericSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/MarkingStructureGenericSchema","eiq-attachments":"#/components/schemas/MarkingStructureEiqAttachmentsSchema","eiq-labels":"#/components/schemas/MarkingStructureEiqLabelsSchema","eiq-overrides":"#/components/schemas/MarkingStructureEiqOverridesSchema","eiq-timestamps":"#/components/schemas/MarkingStructureEiqTimestampsSchema","simple":"#/components/schemas/MarkingStructureSimpleSchema","terms-of-use":"#/components/schemas/MarkingStructureTermsOfUseSchema","tlp":"#/components/schemas/MarkingStructureTlpSchema"},"propertyName":"marking_structure_type"},"oneOf":[{"$ref":"#/components/schemas/MarkingStructureTlpSchema"},{"$ref":"#/components/schemas/MarkingStructureSimpleSchema"},{"$ref":"#/components/schemas/MarkingStructureTermsOfUseSchema"},{"$ref":"#/components/schemas/MarkingStructureEiqTimestampsSchema"},{"$ref":"#/components/schemas/MarkingStructureEiqOverridesSchema"},{"$ref":"#/components/schemas/MarkingStructureEiqLabelsSchema"},{"$ref":"#/components/schemas/MarkingStructureEiqAttachmentsSchema"},{"$ref":"#/components/schemas/MarkingStructureGenericSchema"}],"properties":{"marking_structure_type":{"enum":["tlp","simple","terms-of-use","eiq-timestamps","eiq-overrides","eiq-labels","eiq-attachments","*"],"type":"string"}},"type":"object"},"type":"array"},"type":{"default":"marking-specification","description":"Constant field, must have a value of \"marking-specification\"","type":"string"},"version":{"type":"string"}},"required":["type"],"type":"object"},"MarkingStructureEiqAttachmentsSchema":{"properties":{"attachments":{"items":{"$ref":"#/components/schemas/EclecticIqAttachmentSchema"},"type":"array"},"marking_structure_type":{"default":"eiq-attachments","description":"Constant field, must have a value of \"eiq-attachments\"","type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","type"],"type":"object"},"MarkingStructureEiqLabelsSchema":{"properties":{"marking_structure_type":{"default":"eiq-labels","description":"Constant field, must have a value of \"eiq-labels\"","type":"string"},"tags":{"items":{"type":"string"},"type":"array"},"taxonomy_nodes":{"items":{"type":"string"},"type":"array"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","type"],"type":"object"},"MarkingStructureEiqOverridesSchema":{"properties":{"half_life":{"type":"integer"},"marking_structure_type":{"default":"eiq-overrides","description":"Constant field, must have a value of \"eiq-overrides\"","type":"string"},"title":{"type":"string"},"tlp_color":{"enum":["WHITE","GREEN","AMBER","RED"],"type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","tlp_color","type"],"type":"object"},"MarkingStructureEiqTimestampsSchema":{"properties":{"ingest_time":{"format":"date-time","type":"string"},"marking_structure_type":{"default":"eiq-timestamps","description":"Constant field, must have a value of \"eiq-timestamps\"","type":"string"},"threat_end_time":{"format":"date-time","type":"string"},"threat_observed_time":{"format":"date-time","type":"string"},"threat_start_time":{"format":"date-time","type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","type"],"type":"object"},"MarkingStructureGenericSchema":{"additionalProperties":true,"properties":{"id":{"type":"string"},"idref":{"type":"string"},"marking_model_name":{"type":"string"},"marking_model_ref":{"format":"url","type":"string"},"marking_structure_type":{"type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["type"],"type":"object"},"MarkingStructureSimpleSchema":{"properties":{"marking_structure_type":{"default":"simple","description":"Constant field, must have a value of \"simple\"","type":"string"},"statement":{"type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","statement","type"],"type":"object"},"MarkingStructureTermsOfUseSchema":{"properties":{"marking_structure_type":{"default":"terms-of-use","description":"Constant field, must have a value of \"terms-of-use\"","type":"string"},"terms_of_use":{"type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["marking_structure_type","terms_of_use","type"],"type":"object"},"MarkingStructureTlpSchema":{"properties":{"color":{"enum":["WHITE","GREEN","AMBER","RED"],"type":"string"},"marking_structure_type":{"default":"tlp","description":"Constant field, must have a value of \"tlp\"","type":"string"},"type":{"default":"marking-structure","description":"Constant field, must have a value of \"marking-structure\"","type":"string"}},"required":["color","marking_structure_type","type"],"type":"object"},"MatchingCriteriaSchema":{"properties":{"keywords":{"items":{"type":"string"},"type":"array"},"match_keywords_in":{"description":"List of entity fields to search for keywords. Supported: ['title', 'tags', 'description']","items":{"enum":["title","tags","description"],"type":"string"},"type":"array"}},"type":"object"},"ModelSchema":{"properties":{"model":{"type":"string"},"recommended":{"type":"boolean"}},"required":["model"],"type":"object"},"NameSchema":{"properties":{"value":{"type":"string"}},"required":["value"],"type":"object"},"NodeQuerySchema":{"properties":{"es_query":{"allOf":[{"$ref":"#/components/schemas/ElasticSearchQuerySchema"}],"description":"\nAn ElasticSearch query.\n\nFor the best experience, it is recommended to follow this query structure. It will\nbenefit from automatic Intelligence Center optimizations leading to better results.\n"},"node_type":{"enum":["entity"],"type":"string"}},"required":["es_query","node_type"],"type":"object"},"NotificationAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"event_data":{"readOnly":true},"event_name":{"readOnly":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"importance":{"readOnly":true,"type":"string"},"is_read":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"message_type":{"readOnly":true,"type":"string"},"user":{"description":"URL of the recipient of notification","example":"http://localhost/api/v2/users/1","readOnly":true}},"required":["id"],"type":"object"},"NotificationSettingsSchema":{"properties":{"notify_high_accuracy":{"description":"Notify if ai-based Intel Requirement matched with High accuracy","type":"boolean"},"notify_keyword_match":{"description":"Notify if keyword-based Intel Requirement matched","type":"boolean"},"notify_low_accuracy":{"description":"Notify if ai-based Intel Requirement matched with Low accuracy","type":"boolean"},"notify_medium_accuracy":{"description":"Notify if ai-based Intel Requirement matched with Medium accuracy","type":"boolean"}},"type":"object"},"ObjectiveSchema":{"properties":{"applicability_confidence":{"$ref":"#/components/schemas/ApplicabilityConfidenceSchema"},"description":{"type":"string"},"type":{"default":"objective","description":"Constant field, must have a value of \"objective\"","type":"string"}},"type":"object"},"ObservableAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"entities":{"description":"Entities associated with this observable","example":["http://localhost/api/v2/entities/a7097e6f-1c46-400d-af49-0e4ce6975657"],"items":{"description":"Entity ID/URL","example":"http://localhost/api/v2/entities/a7097e6f-1c46-400d-af49-0e4ce6975657","readOnly":true},"readOnly":true,"type":"array"},"id":{"readOnly":true,"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"meta":{"$ref":"#/components/schemas/ObservableMetaAPISchema"},"sources":{"description":"Sources associated with this observable (currently only one source is allowed)","example":["http://localhost/api/v2/sources/a1711a44-41cc-4c32-aaf1-9bbd734c00c5"],"items":{"description":"Source associated to this object. (ID/URL) Only the source of type {'group'} can be assigned. But any source types may be returned if assigned by the system, like an incoming feed source.","example":"http://localhost/api/v2/sources/a1711a44-41cc-4c32-aaf1-9bbd734c00c5"},"type":"array"},"type":{"enum":["ja3-full","hash-md5","ipv4-cidr","certificate-hash","malware-key","hash-sha384","inetnum","cwe","ipv4","hash-sha224","snort","certificate-serial-number","account-id","handle","certificate-subject","user-agent","person","hash-imphash","process","country","street","name","mutex","container-image-name","certificate-issuer","card","ipv6","organization","host","hash-ssdeep","city","cpu-architecture","uri-hash-sha256","bank-account","domain","ja3s-hash","card-owner","process-name","address","netname","email-subject","jarm","hash-rich-pe-header","geo-long","asn","registrar","email","product","forum-room","ja3-hash","rule","container-registry-account-name","country-code","file","yara","port","industry","forum-thread","winregistry","user-account","region","telephone","hash-vhash","container-cluster-name","device-fingerprint","hash-authentihash","hash-sha256","cloud-storage-bucket","cce","ipv6-cidr","ssh-public-key","nationality","eui-64","ja3s-full","cve","actor-id","geo-lat","hash-sha512","postcode","company","forum-name","geo","hash-sha1","mac-48","file-size","fox-it-portal-uri","uri","malware","crypto-address"],"type":"string"},"value":{"minLength":1,"type":"string"}},"required":["type","value"],"type":"object"},"ObservableActionByQuerySchema":{"properties":{"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query"],"type":"object"},"ObservableDeleteByQueryAPISchema":{"properties":{"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query"],"type":"object"},"ObservableEnrichByQueryAPISchema":{"properties":{"enrichers":{"description":"List of active enricher IDs or URLs","example":["http://localhost/api/v2/enrichers/1"],"items":{"description":"Enricher ID/URL","example":"http://localhost/api/v2/enrichers/1"},"type":"array"},"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query"],"type":"object"},"ObservableExportByQueryAPISchema":{"properties":{"content_configuration":{"$ref":"#/components/schemas/ExtractCsvSchema"},"content_type":{"enum":["urn:eclecticiq.com:advanced-csv-extracts:1.0"],"type":"string"},"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["content_type","observable_query"],"type":"object"},"ObservableMetaAPISchema":{"additionalProperties":true,"properties":{"link_type":{"type":"string"},"maliciousness":{"enum":["unknown","safe","low","medium","high"],"type":"string"},"risk_score":{"description":"To modify risk_score, use `score-updates` endpoint. A value provided here is ignored.","readOnly":true,"type":"string"}},"type":"object"},"ObservableObjectSchema":{"properties":{"properties_xml":{"type":"string"},"properties_xml_type":{"type":"string"},"type":{"default":"cybox-object","description":"Constant field, must have a value of \"cybox-object\"","type":"string"}},"type":"object"},"ObservableRiskScoreUpdateByQueryAPISchema":{"properties":{"comment":{"type":"string"},"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"risk_score":{"enum":["Low","Medium","High","Not Set"],"type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query","risk_score"],"type":"object"},"ObservableRiskScoreUpdateSchema":{"properties":{"comment":{"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"observable_id":{"readOnly":true,"type":"integer"},"score":{"type":"string"},"score_breakdown":{"items":{"$ref":"#/components/schemas/RiskScoreBreakdown"},"readOnly":true,"type":"array"},"score_source":{"readOnly":true,"type":"string"}},"required":["score","score_source"],"type":"object"},"ObservableRuleAPISchema":{"properties":{"action":{"description":"Action that should be executed on the observables that match the rule","example":"classify","type":"string"},"action_details":{"description":"Arguments of the action associated to this rule","example":{"classification":"bad","confidence":"medium"}},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"nullable":true,"type":"string"},"entity_types":{"description":"Types of entities matched by the rule","items":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"},"type":"array"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"link_types":{"description":"List of observable values that the rule should match","items":{"type":"string"},"type":"array"},"name":{"type":"string"},"observable_types":{"description":"Types of observables matched by the rule","items":{"enum":["ja3-full","hash-md5","ipv4-cidr","certificate-hash","malware-key","hash-sha384","inetnum","cwe","ipv4","hash-sha224","snort","certificate-serial-number","account-id","handle","certificate-subject","user-agent","person","hash-imphash","process","country","street","name","mutex","container-image-name","certificate-issuer","card","ipv6","organization","host","hash-ssdeep","city","cpu-architecture","uri-hash-sha256","bank-account","domain","ja3s-hash","card-owner","process-name","address","netname","email-subject","jarm","hash-rich-pe-header","geo-long","asn","registrar","email","product","forum-room","ja3-hash","rule","container-registry-account-name","country-code","file","yara","port","industry","forum-thread","winregistry","user-account","region","telephone","hash-vhash","container-cluster-name","device-fingerprint","hash-authentihash","hash-sha256","cloud-storage-bucket","cce","ipv6-cidr","ssh-public-key","nationality","eui-64","ja3s-full","cve","actor-id","geo-lat","hash-sha512","postcode","company","forum-name","geo","hash-sha1","mac-48","file-size","fox-it-portal-uri","uri","malware","crypto-address"],"type":"string"},"type":"array"},"paths":{"description":"List of paths that the rule should match","items":{"type":"string"},"type":"array"},"source":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/01509aa5-f10a-4d2c-a7a5-11c2780c8d53"},"status":{"description":"Status of the latest rule task execution","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS",null],"nullable":true,"readOnly":true,"type":"string"},"task":{"description":"Task associated to this rule","example":"http://localhost/api/v2/tasks/1","readOnly":true},"values":{"description":"List of observable values that the rule should match","items":{"type":"string"},"type":"array"},"without_link_type":{"description":"Set to true if the rule matches observables without link type","type":"boolean"}},"required":["action","is_active","name"],"type":"object"},"ObservableSchema":{"properties":{"object":{"$ref":"#/components/schemas/ObservableObjectSchema"},"type":{"default":"observable","description":"Constant field, must have a value of \"observable\"","type":"string"}},"type":"object"},"ObservableUpdateByQueryAPISchema":{"properties":{"maliciousness":{"enum":["unknown","safe","low","medium","high"],"type":"string"},"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query"],"type":"object"},"OutgoingFeedAPISchema":{"properties":{"allowed_link_types":{"items":{"enum":["parameter","affected","configuration","vulnerability","weakness","affected-asset","related","observed","sighted","test-mechanism","identity","malicious-infrastructure","targeted-victim","communicates-with","consists-of","drops","downloads","sample","host-vm","operating-system","installed-software","analysis"],"type":"string"},"type":"array"},"allowed_observable_states":{"description":"List of observable states allowed in the feed","items":{"$ref":"#/components/schemas/AllowedObservableStateAPISchema"},"type":"array"},"anonymize_replace_actions":{"items":{"$ref":"#/components/schemas/AnonimizeReplaceActionSchema"},"type":"array"},"anonymize_skip_paths":{"items":{"type":"string"},"nullable":true,"type":"array"},"content_configuration":{"nullable":true},"content_type":{"enum":["urn:eclecticiq.com:advanced-csv-entities:1.0","urn:eclecticiq.com:advanced-csv-extracts:1.0"],"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"datasets":{"description":"List of dataset URLs linked to the outgoing feed","example":["http://localhost/api/v2/datasets/1"],"items":{"description":"Dataset ID/URL","example":"http://localhost/api/v2/datasets/1"},"type":"array"},"delivery_last_run_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"delivery_status":{"enum":["FAILURE","RUNNING","SUCCESS","N/A"],"readOnly":true,"type":"string"},"destination":{"description":"Destination object id","format":"uuid","readOnly":true,"type":"string"},"do_sign_content":{"description":"If true then the platform's private key will be used to sign the payload","type":"boolean"},"enrichment_observable_types":{"description":"Only include these enrichment observable types in the feed","items":{"enum":["ja3-full","hash-md5","ipv4-cidr","certificate-hash","malware-key","hash-sha384","inetnum","cwe","ipv4","hash-sha224","snort","certificate-serial-number","account-id","handle","certificate-subject","user-agent","person","hash-imphash","process","country","street","name","mutex","container-image-name","certificate-issuer","card","ipv6","organization","host","hash-ssdeep","city","cpu-architecture","uri-hash-sha256","bank-account","domain","ja3s-hash","card-owner","process-name","address","netname","email-subject","jarm","hash-rich-pe-header","geo-long","asn","registrar","email","product","forum-room","ja3-hash","rule","container-registry-account-name","country-code","file","yara","port","industry","forum-thread","winregistry","user-account","region","telephone","hash-vhash","container-cluster-name","device-fingerprint","hash-authentihash","hash-sha256","cloud-storage-bucket","cce","ipv6-cidr","ssh-public-key","nationality","eui-64","ja3s-full","cve","actor-id","geo-lat","hash-sha512","postcode","company","forum-name","geo","hash-sha1","mac-48","file-size","fox-it-portal-uri","uri","malware","crypto-address"],"type":"string"},"type":"array"},"execution_schedule":{"allOf":[{"$ref":"#/components/schemas/TaskExecutionScheduleSchema"}],"nullable":true},"export_inactive_only":{"default":false,"description":"Only include data with half-life relevancy below 0.01","type":"boolean"},"half_life_filter":{"nullable":true,"type":"number"},"id":{"readOnly":true,"type":"integer"},"include_without_link_type":{"default":false,"type":"boolean"},"integration_task":{"description":"Integration task associated to this feed","example":"http://localhost/api/v2/tasks/1","readOnly":true},"is_active":{"type":"boolean"},"last_triggered_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"observable_scores":{"description":"Only include these observable risk score value in the feed, if no values are provided, all values are included","items":{"enum":["Low","Medium","High","Not Set"],"type":"string"},"type":"array"},"observable_types":{"description":"Only include these observable types in the feed","items":{"enum":["ja3-full","hash-md5","ipv4-cidr","certificate-hash","malware-key","hash-sha384","inetnum","cwe","ipv4","hash-sha224","snort","certificate-serial-number","account-id","handle","certificate-subject","user-agent","person","hash-imphash","process","country","street","name","mutex","container-image-name","certificate-issuer","card","ipv6","organization","host","hash-ssdeep","city","cpu-architecture","uri-hash-sha256","bank-account","domain","ja3s-hash","card-owner","process-name","address","netname","email-subject","jarm","hash-rich-pe-header","geo-long","asn","registrar","email","product","forum-room","ja3-hash","rule","container-registry-account-name","country-code","file","yara","port","industry","forum-thread","winregistry","user-account","region","telephone","hash-vhash","container-cluster-name","device-fingerprint","hash-authentihash","hash-sha256","cloud-storage-bucket","cce","ipv6-cidr","ssh-public-key","nationality","eui-64","ja3s-full","cve","actor-id","geo-lat","hash-sha512","postcode","company","forum-name","geo","hash-sha1","mac-48","file-size","fox-it-portal-uri","uri","malware","crypto-address"],"type":"string"},"type":"array"},"packaging_last_run_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"packaging_status":{"readOnly":true,"type":"string"},"packing_batch_size_entities":{"type":"integer"},"packing_batch_size_relations":{"default":-1,"description":"Constant field, must have a value of \"-1\"","type":"string"},"require_valid_data":{"default":false,"type":"boolean"},"source_reliability_filter":{"enum":["A","B","C","D","E","F",null],"nullable":true,"type":"string"},"status":{"description":"Status of the latest feed run","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"readOnly":true,"type":"string"},"tlp_color_filter":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"tlp_color_override":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"transport_access_details":{"readOnly":true,"type":"string"},"transport_configuration":{"description":"Outgoing transport specific configuration","nullable":true},"transport_error":{"readOnly":true},"transport_type":{"enum":["eiq.outgoing-transports.email_push","eiq.outgoing-transports.ftp","eiq.outgoing-transports.sftp","eiq.outgoing-transports.mount_point","eiq.outgoing-transports.syslog","eiq.outgoing-transports.http_download","eiq.outgoing-transports.taxii_inbox_push","eiq.outgoing-transports.taxii_poll_passive","eiq.outgoing-transports.taxii21_push","eiq.outgoing-transports.taxii21_poll_passive","eiq.outgoing-transports.ms_defender_endpoint","eiq.outgoing-transports.misp_v2_upload","eiq.outgoing-transports.misp_upload","eiq.outgoing-transports.manageengine","eiq.outgoing-transports.logscale","eiq.outgoing-transports.infoblox_observables_push","eiq.outgoing-transports.cybereason","eiq.outgoing-transports.s3_push","eiq.outgoing-transports.zscaler","eiq.outgoing-transports.qradar","eiq.outgoing-transports.ms_sentinel","eiq.outgoing-transports.ms_sentinel_v2","eiq.outgoing-transports.exabeam","eiq.outgoing-transports.crowdstrike_upload","eiq.outgoing-transports.confluence"],"type":"string"},"update_strategy":{"description":"Configure the behaviour of the feed in case of duplicate content - append, replace or apply the difference","enum":["APPEND","REPLACE","DIFF"],"type":"string"},"update_task":{"description":"Update task associated to this feed","example":"http://localhost/api/v2/tasks/1","readOnly":true},"whitelist_sources":{"description":"List of sources that should be included in the feed","example":["http://localhost/api/v2/sources/b3c60126-327f-44de-beda-a902f3d42595"],"items":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/b3c60126-327f-44de-beda-a902f3d42595"},"type":"array"},"whitelist_tags":{"description":"Only include objects with these tags in the feed","items":{"type":"string"},"type":"array"},"whitelist_taxonomy_nodes":{"description":"List of taxonomies nodes (as IDs or URLs) that should be included in the feed","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"}},"required":["content_type","name","transport_configuration","transport_type"],"type":"object"},"OverviewDashboardAPISchema":{"properties":{"category":{"enum":["entity","observable","dataset","discovery","incoming-feeds","outgoing-feeds","dashboard"],"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"id":{"readOnly":true,"type":"integer"},"ui_metadata":{"description":"The parameters to configure the user interface.","type":"object"},"widgets":{"description":"List of widgets added to the overview dashboard","example":["http://localhost/api/v2/widgets/1"],"items":{"description":"Widget ID/URL","example":"http://localhost/api/v2/widgets/1"},"type":"array"}},"required":["category"],"type":"object"},"ParameterValueCriteriaSchema":{"properties":{"pattern":{"nullable":true,"type":"string"},"related_object_id":{"description":"ID of a related object if value is referencing it. E.g. a `source`"},"value":{"type":"string"},"value_config":{"$ref":"#/components/schemas/ValueSearchInSchema"}},"required":["value"],"type":"object"},"PermissionAPISchema":{"properties":{"id":{"readOnly":true,"type":"integer"},"name":{"type":"string"}},"required":["id","name"],"type":"object"},"PlanningAndOperationalSupportVocabSchema":{"properties":{"value":{"enum":["Data Exploitation","Data Exploitation - Analytic Support","Data Exploitation - Translation Support","Financial Resources","Financial Resources - Academic","Financial Resources - Commercial","Financial Resources - Government","Financial Resources - Hacktivist or Grassroot","Financial Resources - Non-Attributable Finance","Planning","Planning - Open-Source Intelligence (OSINT) Gathering","Planning - Operational Cover Plan","Planning - Pre-Operational Surveillance and Reconnaissance","Planning - Target Selection","Skill Development / Recruitment","Skill Development / Recruitment - Contracting and Hiring","Skill Development / Recruitment - Document Exploitation (DOCEX) Training","Skill Development / Recruitment - Internal Training","Skill Development / Recruitment - Military Programs","Skill Development / Recruitment - Security / Hacker Conferences","Skill Development / Recruitment - Underground Forums","Skill Development / Recruitment - University Programs"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1\"","type":"string"}},"required":["value"],"type":"object"},"ProcessorArchitectureVocabSchema":{"properties":{"value":{"enum":["alpha","arm","ia-64","mips","powerpc","sparc","x86","x86-64"],"type":"string"},"vocab":{"default":"processor-architecture-ov","description":"Constant field, must have a value of \"processor-architecture-ov\"","type":"string"}},"required":["value"],"type":"object"},"ProducerSchema":{"properties":{"identity":{"$ref":"#/components/schemas/InformationSourceIdentitySchema"},"references":{"items":{"format":"url","type":"string"},"type":"array"},"time_end":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_end_precision":{"enum":["day","hour","minute","month","second","year"],"type":"string"},"time_received":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_received_precision":{"enum":["day","hour","minute","month","second","year"],"type":"string"},"time_start":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"time_start_precision":{"enum":["day","hour","minute","month","second","year"],"type":"string"},"type":{"default":"information-source","description":"Constant field, must have a value of \"information-source\"","type":"string"}},"type":"object"},"PropertiesAffectedSchema":{"properties":{"description_of_effect":{"type":"string"},"duration_of_availability_loss":{"enum":["Days","Hours","Minutes","Permanent","Seconds","Unknown","Weeks"],"type":"string"},"non_public_data_compromised":{"enum":["No","Suspected","Unknown","Yes"],"type":"string"},"property":{"enum":["Accountability","Availability","Confidentiality","Integrity","Non-Repudiation"],"type":"string"},"type":{"default":"property-affected","description":"Constant field, must have a value of \"property-affected\"","type":"string"},"type_of_availability_loss":{"enum":["Acceleration","Degradation","Destruction","Interruption","Loss","Obscuration","Unknown"],"type":"string"}},"type":"object"},"PropertyBlockContainerSchema":{"properties":{"blocks":{"items":{"$ref":"#/components/schemas/PropertyBlockItemSchema"},"type":"array"},"is_enabled":{"type":"boolean"}},"type":"object"},"PropertyBlockItemSchema":{"properties":{"type":{"enum":["STIX_ID","Source","Date","Version","TLP","Intent"],"type":"string"},"value":{"nullable":true,"type":"string"}},"required":["type","value"],"type":"object"},"PropertyPropagationAPISchema":{"properties":{"copy_fields":{"additionalProperties":{"$ref":"#/components/schemas/CopyFieldSchema"},"type":"object"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"nullable":true,"type":"string"},"execution_schedule":{"allOf":[{"$ref":"#/components/schemas/TaskExecutionScheduleSchema"}],"nullable":true},"filtering_criteria":{"$ref":"#/components/schemas/FilteringCriteriaSchema1"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"is_retroactive":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"related_directly":{"type":"boolean"},"related_through_entities":{"type":"boolean"},"related_through_observables":{"type":"boolean"},"task":{"description":"PropertyPropagationTask object id","format":"int32","readOnly":true,"type":"integer"},"time_field":{"enum":["ingestion","start","observed",null],"nullable":true,"type":"string"},"time_period":{"nullable":true,"type":"integer"}},"required":["copy_fields","filtering_criteria","is_active","is_retroactive","name"],"type":"object"},"PublicAttackPatternDataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"original_eiqjson1_entity":{"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"attack-pattern","description":"Constant field, must have a value of \"attack-pattern\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicIdentityDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"identity_class":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","identity-class-ov":"#/components/schemas/IdentityClassVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/IdentityClassVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["identity-class-ov","*"],"type":"string"}},"type":"object"},"identity_specification":{"$ref":"#/components/schemas/CIQIdentitySchema"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"original_eiqjson1_entity":{"type":"object"},"roles":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"sectors":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","industry-sector-ov":"#/components/schemas/IndustrySectorVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/IndustrySectorVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["industry-sector-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"identity","description":"Constant field, must have a value of \"identity\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicInfrastructureDataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"infrastructure_types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","infrastructure-type-ov":"#/components/schemas/InfrastructureTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/InfrastructureTypeVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["infrastructure-type-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"original_eiqjson1_entity":{"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"infrastructure","description":"Constant field, must have a value of \"infrastructure\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicIntrusionSetDataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"intended_effects":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0":"#/components/schemas/IntendedEffectVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/IntendedEffectVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"motivations":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","attack-motivation-ov":"#/components/schemas/AttackMotivationVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackMotivationVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["attack-motivation-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"original_eiqjson1_entity":{"type":"object"},"planning_and_operational_support":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1":"#/components/schemas/PlanningAndOperationalSupportVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/PlanningAndOperationalSupportVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1","*"],"type":"string"}},"type":"object"},"type":"array"},"resource_level":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","attack-resource-level-ov":"#/components/schemas/AttackResourceLevelVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackResourceLevelVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["attack-resource-level-ov","*"],"type":"string"}},"type":"object"},"sophistication":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","threat-actor-sophistication-ov":"#/components/schemas/ThreatActorSophisticationVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ThreatActorSophisticationVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["threat-actor-sophistication-ov","*"],"type":"string"}},"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"intrusion-set","description":"Constant field, must have a value of \"intrusion-set\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicKeyDetailsSchema":{"properties":{"description":{"type":"string"},"fingerprint":{"readOnly":true,"type":"string"},"key":{"type":"string"},"keyid":{"readOnly":true,"type":"string"}},"required":["description","key"],"type":"object"},"PublicLocationDataSchema":{"additionalProperties":true,"properties":{"administrative_area":{"description":"Should be a valid ISO-3166-2 subdivision code.","type":"string"},"city":{"type":"string"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"country":{"description":"Should be a valid ISO-3166-2 ALPHA-2 code.","type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"$ref":"#/components/schemas/ExternalReferenceSchema"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"latitude":{"type":"number"},"longitude":{"type":"number"},"postal_code":{"type":"string"},"precision":{"type":"number"},"region":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","region-ov":"#/components/schemas/RegionVocabularySchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/RegionVocabularySchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["region-ov","*"],"type":"string"}},"type":"object"},"street_address":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"location","description":"Constant field, must have a value of \"location\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicMalwareAnalysisDataSchema":{"additionalProperties":true,"properties":{"analysis_definition_version":{"type":"string"},"analysis_engine_version":{"type":"string"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"configuration_version":{"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"modules":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"product":{"type":"string"},"result":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","malware-result-ov":"#/components/schemas/MalwareResultVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/MalwareResultVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["malware-result-ov","*"],"type":"string"}},"type":"object"},"result_name":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"malware-analysis","description":"Constant field, must have a value of \"malware-analysis\"","type":"string"},"version":{"type":"string"}},"required":["product","title","type"],"type":"object"},"PublicMalwareDataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"architecture_execution_envs":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","processor-architecture-ov":"#/components/schemas/ProcessorArchitectureVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ProcessorArchitectureVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["processor-architecture-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"capabilities":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","malware-capabilities-ov":"#/components/schemas/MalwareCapabilityVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/MalwareCapabilityVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["malware-capabilities-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"implementation_languages":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","implementation-language-ov":"#/components/schemas/ImplementationLanguageVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ImplementationLanguageVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["implementation-language-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"is_family":{"default":false,"type":"boolean"},"malware_types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","malware-type-ov":"#/components/schemas/MalwareTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/MalwareTypeVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["malware-type-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"original_eiqjson1_entity":{"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"malware","description":"Constant field, must have a value of \"malware\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicNoteDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"$ref":"#/components/schemas/ExternalReferenceSchema"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"note","description":"Constant field, must have a value of \"note\"","type":"string"}},"required":["title","type"],"type":"object"},"PublicTTPDataSchema":{"additionalProperties":true,"properties":{"behavior":{"$ref":"#/components/schemas/TTPBehaviorSchema"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"id_namespaces":{"additionalProperties":{"type":"string"},"type":"object"},"idref":{"minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"intended_effects":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"value_vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"StatementSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/StatementSchema","{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0":"#/components/schemas/IntendedEffectStatementSchema"},"propertyName":"value_vocab"},"oneOf":[{"$ref":"#/components/schemas/IntendedEffectStatementSchema"},{"$ref":"#/components/schemas/StatementSchema"}],"properties":{"value_vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"kill_chain_phases":{"items":{"$ref":"#/components/schemas/KillChainPhaseReferenceSchema"},"type":"array"},"kill_chains":{"items":{"$ref":"#/components/schemas/KillChainSchema"},"type":"array"},"resources":{"$ref":"#/components/schemas/TTPResourceSchema"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"ttp","description":"Constant field, must have a value of \"ttp\"","type":"string"},"version":{"type":"string"},"victim_targeting":{"$ref":"#/components/schemas/TTPVictimTargetingSchema"}},"required":["title","type"],"type":"object"},"PublicThreatActorV2DataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"identity":{"$ref":"#/components/schemas/CIQIdentitySchema"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"intended_effects":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0":"#/components/schemas/IntendedEffectVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/IntendedEffectVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}IntendedEffectVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"motivations":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","attack-motivation-ov":"#/components/schemas/AttackMotivationVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackMotivationVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["attack-motivation-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"personal_motivations":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","attack-motivation-ov":"#/components/schemas/AttackMotivationVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackMotivationVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["attack-motivation-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"planning_and_operational_support":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1":"#/components/schemas/PlanningAndOperationalSupportVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/PlanningAndOperationalSupportVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}PlanningAndOperationalSupportVocab-1.0.1","*"],"type":"string"}},"type":"object"},"type":"array"},"resource_level":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","attack-resource-level-ov":"#/components/schemas/AttackResourceLevelVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackResourceLevelVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["attack-resource-level-ov","*"],"type":"string"}},"type":"object"},"roles":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","threat-actor-role-ov":"#/components/schemas/ThreatActorRoleVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ThreatActorRoleVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["threat-actor-role-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"sophistication":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","threat-actor-sophistication-ov":"#/components/schemas/ThreatActorSophisticationVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ThreatActorSophisticationVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["threat-actor-sophistication-ov","*"],"type":"string"}},"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"default":"threat-actor","description":"Constant field, must have a value of \"threat-actor\"","type":"string"},"types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","threat-actor-type-ov":"#/components/schemas/ThreatActorTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ThreatActorTypeVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["threat-actor-type-ov","*"],"type":"string"}},"type":"object"},"type":"array"}},"required":["title","type"],"type":"object"},"PublicToolDataSchema":{"additionalProperties":true,"properties":{"aliases":{"items":{"$ref":"#/components/schemas/NameSchema"},"type":"array"},"architecture_execution_envs":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","processor-architecture-ov":"#/components/schemas/ProcessorArchitectureVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ProcessorArchitectureVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["processor-architecture-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"external_references":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"source_name\" property. If the value doesn't match a specific schema, the schema named \"ExternalReferenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ExternalReferenceSchema","capec":"#/components/schemas/CapecExternalReferenceSchema"},"propertyName":"source_name"},"oneOf":[{"$ref":"#/components/schemas/CapecExternalReferenceSchema"},{"$ref":"#/components/schemas/ExternalReferenceSchema"}],"properties":{"source_name":{"enum":["capec","*"],"type":"string"}},"required":["source_name"],"type":"object"},"type":"array"},"handling":{"items":{"$ref":"#/components/schemas/MarkingSpecificationSchema"},"type":"array"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"implementation_languages":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","implementation-language-ov":"#/components/schemas/ImplementationLanguageVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ImplementationLanguageVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["implementation-language-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"information_source":{"$ref":"#/components/schemas/InformationSourceSchema"},"original_eiqjson1_entity":{"type":"object"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"tool_types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"GenericVocabSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/GenericVocabSchema","tool-type-ov":"#/components/schemas/ToolTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/ToolTypeVocabSchema"},{"$ref":"#/components/schemas/GenericVocabSchema"}],"properties":{"vocab":{"enum":["tool-type-ov","*"],"type":"string"}},"type":"object"},"type":"array"},"tool_version":{"type":"string"},"type":{"default":"tool","description":"Constant field, must have a value of \"tool\"","type":"string"}},"required":["title","type"],"type":"object"},"ReasonSchema":{"properties":{"reason":{"type":"string"},"reason_category":{"type":"string"},"reason_type":{"enum":["Positive","Negative"],"type":"string"}},"required":["reason","reason_category"],"type":"object"},"RegionVocabularySchema":{"properties":{"value":{"enum":["africa","eastern-africa","middle-africa","northern-africa","southern-africa","western-africa","americas","carebbean","central-america","latin-america-caribbean","northern-america","south-america","asia","central-asia","eastern-asia","southern-asia","south-eastern-asia","western-asia","europe","eastern-europe","northern-europe","southern-europe","western-europe","oceania","antarctica","australia-new-zealand","melanesia","micronesia","polynesia"],"type":"string"},"vocab":{"default":"region-ov","description":"Constant field, must have a value of \"region-ov\"","type":"string"}},"required":["value"],"type":"object"},"RegularHeaderFooterContainerSchema":{"properties":{"is_enabled":{"type":"boolean"},"sections":{"items":{"$ref":"#/components/schemas/HeaderFooterSectionSchema"},"type":"array"}},"type":"object"},"RelatedEntitySchema":{"properties":{"entity_description":{"type":"string"},"entity_title":{"type":"string"},"entity_type":{"type":"string"},"relationship":{"type":"string"},"source_ids":{"items":{"type":"string"},"type":"array"}},"type":"object"},"RelationAPISchema":{"properties":{"id":{"items":{"type":"string"},"type":"array"}},"type":"object"},"RelationalQueryAPISchema":{"properties":{"include_indirectly_related":{"default":false,"description":"\nThis flag when set to `True` allows to also include the entities that related\nindirectly to the other query. An indirect relation means that another entity,\nwithout specific criteria, connect entities from both queries.\nBy default, it is `False` so only the entities directly related are returned.\n","type":"boolean"},"output":{"description":"choose which nodes of relational query to return, either `query_1` or `query_2` is a valid option","enum":["query_1","query_2"],"type":"string"},"query_1":{"allOf":[{"$ref":"#/components/schemas/NodeQuerySchema"}],"description":"Elasticsearch query matching entities (nodes) representing relation source(s)."},"query_2":{"allOf":[{"$ref":"#/components/schemas/NodeQuerySchema"}],"description":"Elasticsearch query matching entities (nodes) representing relation target(s)."},"relation_query":{"description":"Elasticsearch query for relationship object itself (defaults to `*`)","type":"object"}},"required":["output","query_1","query_2","relation_query"],"type":"object"},"RelationshipAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"data":{"$ref":"#/components/schemas/RelationshipDataAPISchema"},"id":{"format":"uuid","type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"meta":{"$ref":"#/components/schemas/RelationshipMetaAPISchema"},"sources":{"description":"[Collection of] Source associated to this object. (ID/URL) Only the source of type {'group'} can be assigned. But any source types may be returned if assigned by the system, like an incoming feed source.","example":["http://localhost/api/v2/sources/aadcb1f9-5aaf-4131-83ab-e91f6185893b"],"items":{"description":"Source associated to this object. (ID/URL) Only the source of type {'group'} can be assigned. But any source types may be returned if assigned by the system, like an incoming feed source.","example":"http://localhost/api/v2/sources/aadcb1f9-5aaf-4131-83ab-e91f6185893b"},"maxItems":1,"minItems":1,"type":"array"},"strict_stix_1":{"readOnly":true,"type":"boolean"},"strict_stix_2":{"readOnly":true,"type":"boolean"}},"required":["data","sources"],"type":"object"},"RelationshipDataAPISchema":{"properties":{"description":{"description":"A description that provides more details and context about the Relationship, potentially including its purpose and its key characteristics.","nullable":true,"type":"string"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"key":{"description":"EIQ JSON relation key e.g. `based-on`. The value of this property must be in ASCII, no longer than 256 characters and is limited to characters a–z (lowercase ASCII), 0–9, and hyphen (-).","nullable":true,"pattern":"^[a-z0-9\\-]{1,256}$","type":"string"},"source":{"description":"Source EIQ entity ID, STIX ID or API entity URL","example":"http://localhost/api/v2/entities/1a91dc13-4a84-4624-b99a-9ea14f4448df"},"subtype":{"description":"This field is currently only used for 'stix_update_of'. It indicates that the source entity is an update of the target one. The target entity is going to be marked as outdated. The key is ignored when this property is set.","enum":["stix_update_of"],"type":"string"},"target":{"description":"Target EIQ entity ID or STIX ID or API entity URL","example":"http://localhost/api/v2/entities/f91ca45e-4fd4-4242-a190-d0c47e3527c1"},"timestamp":{"description":"Relationship last modification timestamp in ISO-8601 format (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"}},"required":["source","target"],"type":"object"},"RelationshipMetaAPISchema":{"properties":{"estimated_threat_end_time":{"description":"\nThe latest time at which the Relationship between the objects exists. If\nthis property is a future timestamp, at the time the\n`estimated_threat_end_time` property is defined, then this represents an\nestimate by the producer of the intelligence of the latest time at which\nrelationship will be asserted to be true.\n\nIf `estimated_threat_start_time` and `estimated_threat_end_time` are\nboth defined, then `estimated_threat_end_time` MUST be later than the\n`estimated_threat_start_time` value.\n\nIf `estimated_threat_end_time` is not specified, then the latest time at\nwhich the relationship between the objects exists is either not known,\nnot disclosed, or has no defined stop time.\n","format":"date-time","nullable":true,"type":"string"},"estimated_threat_start_time":{"description":"\nThis optional timestamp represents the earliest time at which the\nRelationship between the objects exists. If this property is a future\ntimestamp, at the time the `estimated_threat_start_time` property is\ndefined, then this represents an estimate by the producer of the\nintelligence of the earliest time at which relationship will be asserted\nto be true.\n\nIf it is not specified, then the earliest time at which the relationship\nbetween the objects exists is not defined.\n","format":"date-time","nullable":true,"type":"string"},"external_ids":{"items":{"type":"string"},"type":"array"},"is_rewired":{"description":"Indicates if this relation has its source/target Entity that have been merged. When an entity is merged all the relations are copied to the master entity. A missing value implies False.","readOnly":true,"type":"boolean"},"is_rewired_by":{"description":"The UUID id of the master entity. This field is only present if `is_rewired` is `True`.","format":"uuid","readOnly":true,"type":"string"},"source_reliability":{"enum":["A","B","C","D","E","F",null],"nullable":true,"readOnly":true,"type":"string"},"stix_id":{"readOnly":true,"type":"string"},"tlp_color":{"description":"The current TLP value.\n\nThe values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"},"tlp_color_original":{"description":"The value of the very first TLP set.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"readOnly":true,"type":"string"}},"type":"object"},"ReportDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"information_source":{"$ref":"#/components/schemas/InformationSourceAPISchema"},"intents":{"items":{"$ref":"#/components/schemas/ReportIntentsSchema"},"type":"array"},"short_description":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"}},"required":["title","type"],"type":"object"},"ReportIntentsSchema":{"properties":{"value":{"enum":["Attack Pattern Characterization","Campaign Characterization","Collective Threat Intelligence","Courses of Action","Exploit Characterization","Incident","Indicators","Indicators - Endpoint Characteristics","Indicators - Malware Artifacts","Indicators - Network Activity","Indicators - Phishing","Indicators - Watchlist","Malware Characterization","Malware Samples","Observations","Observations - Email","TTP - Infrastructure","TTP - Tools","Threat Actor Characterization","Threat Report"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}ReportIntentVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}ReportIntentVocab-1.0\"","type":"string"}},"type":"object"},"ReportTemplateAttachmentSchema":{"properties":{"data":{"type":"string","writeOnly":true},"id":{"readOnly":true,"type":"integer"},"name":{"readOnly":true,"type":"string"},"url":{"readOnly":true}},"type":"object"},"ReportTemplateDetailSchema":{"properties":{"content":{"nullable":true,"type":"string"},"cover_page_config":{"$ref":"#/components/schemas/CoverPageContainerSchema"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"description":{"nullable":true,"type":"string"},"id":{"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"property_block_config":{"$ref":"#/components/schemas/PropertyBlockContainerSchema"},"regular_footer_config":{"$ref":"#/components/schemas/RegularHeaderFooterContainerSchema"},"regular_header_config":{"$ref":"#/components/schemas/RegularHeaderFooterContainerSchema"},"sub_title_config":{"$ref":"#/components/schemas/TitleSchema"},"super_title_config":{"$ref":"#/components/schemas/TitleSchema"},"text_styles":{"items":{"$ref":"#/components/schemas/TextStyleSchema"},"type":"array"},"title":{"nullable":true,"type":"string"},"tlp":{"nullable":true,"type":"string"}},"type":"object"},"ReportTemplateSchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"description":{"type":"string"},"id":{"readOnly":true,"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"}},"required":["name"],"type":"object"},"ReportTemplateSummarySchema":{"properties":{"id":{"description":"ID of the associated report template","nullable":true,"type":"integer"},"sub_title":{"description":"Sub title of the report","nullable":true,"type":"string"},"super_title":{"description":"Super title of the report","nullable":true,"type":"string"}},"type":"object"},"RiskScoreBreakdown":{"properties":{"parameters":{"additionalProperties":{"items":{"additionalProperties":{"type":"string"},"type":"object"},"type":"array"},"type":"object"},"policy_id":{"description":"RiskScorePolicy ID/URL","example":"http://localhost/api/v2/risk-score-policy/1","readOnly":true},"score":{"type":"string"}},"required":["score"],"type":"object"},"RiskScoreDecaySchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"n_days":{"type":"integer"},"observable_type":{"enum":["ja3-full","hash-md5","ipv4-cidr","hash-sha384","inetnum","ipv4","hash-sha224","hash-vhash","hash-authentihash","hash-imphash","hash-sha256","ipv6","hash-ssdeep","ipv6-cidr","domain","ja3s-hash","email-subject","hash-rich-pe-header","actor-id","asn","hash-sha512","email","hash-sha1","ja3-hash","uri","malware"],"type":"string"}},"required":["n_days","observable_type"],"type":"object"},"RiskScoreParameterAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"id":{"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"readOnly":true,"type":"string"},"policy_id":{"description":"RiskScorePolicy ID/URL","example":"http://localhost/api/v2/risk-score-policy/1","readOnly":true}},"required":["is_active","name"],"type":"object"},"RiskScoreParameterValueAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"criteria":{"$ref":"#/components/schemas/ParameterValueCriteriaSchema"},"id":{"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"parameter_id":{"description":"RiskScoreParameter ID/URL","example":"http://localhost/api/v2/risk-score-policy-parameter/1","readOnly":true},"score":{"enum":["Low","Medium","High","Not Set"],"type":"string"}},"required":["criteria","score"],"type":"object"},"RiskScorePolicyAPISchema":{"properties":{"apply_task":{"description":"Task associated to this policy","example":"http://localhost/api/v2/tasks/1","readOnly":true},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"id":{"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"observable_types":{"items":{"enum":["ja3-full","hash-md5","ipv4-cidr","hash-sha384","inetnum","ipv4","hash-sha224","hash-vhash","hash-authentihash","hash-imphash","hash-sha256","ipv6","hash-ssdeep","ipv6-cidr","domain","ja3s-hash","email-subject","hash-rich-pe-header","actor-id","asn","hash-sha512","email","hash-sha1","ja3-hash","uri","malware"],"type":"string"},"type":"array"},"score_thresholds":{"$ref":"#/components/schemas/ScoreThresholdSchema"}},"required":["is_active","name","observable_types"],"type":"object"},"RiskScorePolicyPreviewAPISchema":{"properties":{"observable":{"$ref":"#/components/schemas/ObservableAPISchema"},"score_preview":{"allOf":[{"$ref":"#/components/schemas/RiskScoreBreakdown"}],"nullable":true}},"type":"object"},"RiskScorePolicyPreviewByQueryAPISchema":{"properties":{"observable_query":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"time_zone":{"description":"Timezone in Coordinated Universal Time (UTC) offset format","example":"+01:00 or -08:00","pattern":"[\\+,-][0-9][0-9]:[0-9][0-9]"}},"required":["observable_query"],"type":"object"},"RoleAPISchema":{"properties":{"created_at":{"description":"User role creation date (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"type":"string"},"id":{"description":"Role ID","readOnly":true,"type":"integer"},"last_updated_at":{"description":"User role last update date (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"description":"Role name","example":"admin","type":"string"},"permissions":{"description":"List of permissions associated to this role","example":["http://localhost/api/v2/permissions/1"],"items":{"description":"Permissions ID/URL","example":"http://localhost/api/v2/permissions/1"},"type":"array"},"users":{"description":"List of users associated to this role","example":["http://localhost/api/v2/users/1"],"items":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"readOnly":true,"type":"array"}},"required":["id","name"],"type":"object"},"RolesSchema":{"properties":{"value":{"enum":["Aggregator","Content Enhancer/Refiner","Initial Author","Transformer/Translator"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}InformationSourceRoleVocab-1.0\"","type":"string"}},"type":"object"},"RuleAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"status":{"description":"Status of the latest rule task execution","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS",null],"nullable":true,"readOnly":true,"type":"string"}},"required":["is_active","name"],"type":"object"},"SandboxDetonationSchema":{"properties":{"completed_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"detonation_type":{"enum":["hash","url","file"],"type":"string"},"detonator_task_id":{"type":"integer"},"detonator_task_name":{"readOnly":true,"type":"string"},"error_result":{"readOnly":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"job_id":{"readOnly":true,"type":"string"},"name":{"type":"string"},"parameters":{"type":"object"},"report_supported_type":{"items":{"type":"string"},"readOnly":true,"type":"array"},"scan_type":{"enum":["Static","Dynamic"],"type":"string"},"status":{"enum":["Success","Processing","Failed","Pending"],"readOnly":true,"type":"string"},"terms_accepted":{"type":"boolean"},"vendor_report_url":{"nullable":true,"readOnly":true,"type":"string"},"verdict":{"enum":["Suspicious","Informative","Unknown","Malicious","Not Detonated"],"readOnly":true,"type":"string"},"verdict_reason":{"readOnly":true,"type":"string"}},"required":["detonation_type","name","scan_type","terms_accepted"],"type":"object"},"SandboxReportSchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"html_report":{"type":"string"},"id":{"readOnly":true,"type":"integer"},"sandbox_detonation_id":{"readOnly":true,"type":"integer"}},"type":"object"},"SandboxResultSchema":{"properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"description":{"nullable":true,"type":"string"},"entities":{"items":{"$ref":"#/components/schemas/DetonationResultEntitySchema"},"nullable":true,"type":"array"},"extracts":{"items":{"$ref":"#/components/schemas/DetonationResultExtractSchema"},"nullable":true,"type":"array"},"id":{"readOnly":true,"type":"integer"},"mitres":{"items":{"$ref":"#/components/schemas/DetonationMitreAttackSchema"},"nullable":true,"type":"array"},"tags":{"items":{"type":"string"},"nullable":true,"type":"array"}},"type":"object"},"ScoreThresholdSchema":{"properties":{"high_score_threshold":{"description":"Minimal number of parameters that need to score High for an overall High score","type":"integer"},"medium_score_threshold":{"description":"Minimal number of parameters that need to score Mediun for an overall Medium score","type":"integer"}},"required":["high_score_threshold","medium_score_threshold"],"type":"object"},"SightingDataSchema":{"additionalProperties":true,"properties":{"confidence":{"enum":["unknown","none","high","low","medium"],"type":"string"},"custom_attributes":{},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"description":"STIX ID to uniquely identify the object. If none is specified on an entity payload then the platform will automatically generate a STIX ID in the format `{platform-namespace-url}type-UUID`.","example":"{https://example.com}indicator-da747dd9-5564-44e1-aa24-8b527dfb8868","minLength":1,"type":"string"},"impact":{"$ref":"#/components/schemas/SightingImpactSchema"},"raw_events":{"type":"string"},"security_control":{"$ref":"#/components/schemas/ProducerSchema"},"short_description":{"type":"string"},"timestamp":{"description":"Entity timestamp (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"title":{"type":"string"},"type":{"enum":["attack-pattern","campaign","course-of-action","exploit-target","identity","incident","indicator","infrastructure","intrusion-set","location","malware","malware-analysis","report","eclecticiq-sighting","threat-actor","tool","ttp","custom-entity"],"type":"string"}},"required":["title","type"],"type":"object"},"SightingImpactSchema":{"properties":{"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["High","Low","Medium","None","Unknown"],"type":"string"},"value_vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0\"","type":"string"}},"type":"object"},"SimplifiedRelationalQueryAPISchema":{"properties":{"include_indirectly_related":{"default":false,"description":"This flag when set to `True` allows to also include the entities that related indirectly to the other query. An indirect relation means that another entity, without specific criteria, connect entities from both queries. By default, it is `False` so only the entities directly related are returned. ","type":"boolean"},"output":{"description":"choose which nodes of relational query to return, either `query_1` or `query_2` is a valid option","enum":["query_1","query_2"],"type":"string"},"query_1":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"query_2":{"description":"\nFull-text or faceted search with logic operators\nlike `AND` and `OR`.\n\nThe language of the search queries is Lucene and the\ncapability is the same as the one in Intelligence Center\nUI. Read more in [its documentation](\nhttps://docs.eclecticiq.com/ic/3.1.0/get-to-know-the-ic/search/).\n","example":"data.title:malware OR data.description:APT17","type":"string"},"relation_query":{"description":"Elasticsearch query for relationship object itself (defaults to `*`)","example":"data.title:malware OR data.description:APT17","type":"string"}},"required":["output","query_1","query_2","relation_query"],"type":"object"},"SnortTestMechanismTypeSchema":{"properties":{"efficacy":{"$ref":"#/components/schemas/TestMechanismEfficacySchema"},"event_filters":{"items":{"$ref":"#/components/schemas/ValueSchema"},"type":"array"},"event_suppressions":{"items":{"$ref":"#/components/schemas/ValueSchema"},"type":"array"},"producer":{"$ref":"#/components/schemas/ProducerSchema"},"product_name":{"type":"string"},"rate_filters":{"items":{"$ref":"#/components/schemas/ValueSchema"},"type":"array"},"rules":{"items":{"$ref":"#/components/schemas/TestMechanismRulesSchema"},"type":"array"},"test_mechanism_type":{"enum":["generic","snort","yara"],"type":"string"},"type":{"default":"test-mechanism","description":"Constant field, must have a value of \"test-mechanism\"","type":"string"},"version":{"minLength":1,"type":"string"}},"required":["test_mechanism_type","version"],"type":"object"},"SourceAPISchema":{"properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"id":{"format":"uuid","readOnly":true,"type":"string"},"last_updated_at":{"format":"date-time","readOnly":true,"type":"string"},"name":{"type":"string"},"reliability":{"enum":["A","B","C","D","E","F",null],"nullable":true,"type":"string"},"source_type":{"type":"string"}},"required":["id"],"type":"object"},"StandaloneApiAccountPolicySchema":{"properties":{"account_policy_enabled":{},"last_updated_at":{"format":"date-time","readOnly":true,"type":"string"},"lockout_attempts":{"default":5,"maximum":1000,"minimum":0,"type":"integer"},"password_min_length":{"default":10,"maximum":64,"minimum":8,"type":"integer"},"password_requires_capital_letters":{"default":true,"type":"boolean"},"password_requires_numbers":{"default":true,"type":"boolean"},"password_requires_special_chars":{"default":true,"type":"boolean"},"password_reset_link_expiry_in_seconds":{"default":604800,"maximum":31536000,"minimum":3600,"type":"integer"},"two_factor_authn_enforced":{"type":"boolean"},"two_factor_suspension_min":{"maximum":525600,"minimum":0,"type":"integer"},"type":{"type":"string"}},"required":["type"],"type":"object"},"StatementSchema":{"properties":{"confidence":{"description":"This object will be validated with a schema selected based on the value of the \"value_vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ConfidenceSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ConfidenceSchema","{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0":"#/components/schemas/ConfidenceHighMediumLowVocabSchema"},"propertyName":"value_vocab"},"oneOf":[{"$ref":"#/components/schemas/ConfidenceHighMediumLowVocabSchema"},{"$ref":"#/components/schemas/ConfidenceSchema"}],"properties":{"value_vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}HighMediumLowVocab-1.0","*"],"type":"string"}},"type":"object"},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"type":"string"},"idref":{"type":"string"},"timestamp":{"format":"date-time","nullable":true,"type":"string"},"timestamp_precision":{"enum":["year","month","day","hour","minute","second"],"type":"string"},"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"type":"string"},"value_vocab":{"type":"string"},"value_vocab_name":{"type":"string"},"value_vocab_reference":{"type":"string"}},"required":["type"],"type":"object"},"SystemConfigurationSchema":{"properties":{"data":{"description":"This object will be validated with a schema selected based on the value of the \"type\" property.","discriminator":{"mapping":{"account-policy":"#/components/schemas/ApiAccountPolicySchema","configuration-bundles-producer":"#/components/schemas/ApiConfigurationBundlesProducerConfigSchema","email":"#/components/schemas/ApiEmailSchema","intel-report":"#/components/schemas/ApiIntelReportSchema","license":"#/components/schemas/ApiLicenseSchema","private-key":"#/components/schemas/ApiPrivateKeySchema","server":"#/components/schemas/ApiServerSchema","stix":"#/components/schemas/ApiStixSchema","trusted-public-keys":"#/components/schemas/ApiPublicKeysSchema"},"propertyName":"type"},"oneOf":[{"$ref":"#/components/schemas/ApiAccountPolicySchema"},{"$ref":"#/components/schemas/ApiConfigurationBundlesProducerConfigSchema"},{"$ref":"#/components/schemas/ApiEmailSchema"},{"$ref":"#/components/schemas/ApiIntelReportSchema"},{"$ref":"#/components/schemas/ApiLicenseSchema"},{"$ref":"#/components/schemas/ApiPrivateKeySchema"},{"$ref":"#/components/schemas/ApiServerSchema"},{"$ref":"#/components/schemas/ApiStixSchema"},{"$ref":"#/components/schemas/ApiPublicKeysSchema"}],"properties":{"type":{"enum":["account-policy","configuration-bundles-producer","email","intel-report","license","private-key","server","stix","trusted-public-keys"],"type":"string"}},"required":["type"],"type":"object"}},"required":["data"],"type":"object"},"SystemSettingSchema":{"properties":{"data":{"description":"This object will be validated with a schema selected based on the value of the \"type\" property.","discriminator":{"mapping":{"ai_provider_feature_availability":"#/components/schemas/AiProviderFeatureAvailabilitySchema"},"propertyName":"type"},"oneOf":[{"$ref":"#/components/schemas/AiProviderFeatureAvailabilitySchema"}],"properties":{"type":{"enum":["ai_provider_feature_availability"],"type":"string"}},"readOnly":true,"required":["type"],"type":"object"}},"type":"object"},"SystemTypeVocabSchema":{"properties":{"value":{"enum":["Enterprise Systems","Enterprise Systems - Application Layer","Enterprise Systems - Database Layer","Enterprise Systems - Enterprise Technologies and Support Infrastructure","Enterprise Systems - Network Systems","Enterprise Systems - Networking Devices","Enterprise Systems - Web Layer","Enterprise Systems - VoIP","Industrial Control Systems","Industrial Control Systems - Equipment Under Control","Industrial Control Systems - Operations Management","Industrial Control Systems - Safety, Protection and Local Control","Industrial Control Systems - Supervisory Control","Mobile Systems","Mobile Systems - Mobile Operating Systems","Mobile Systems - Near Field Communications","Mobile Systems - Mobile Devices","Third-Party Services","Third-Party Services - Application Stores","Third-Party Services - Cloud Services","Third-Party Services - Security Vendors","Third-Party Services - Social Media","Third-Party Services - Software Update","Users","Users - Application And Software","Users - Workstation","Users - Removable Media"],"type":"string"},"vocab":{"default":"{http://stix.mitre.org/default_vocabularies-1}SystemTypeVocab-1.0","description":"Constant field, must have a value of \"{http://stix.mitre.org/default_vocabularies-1}SystemTypeVocab-1.0\"","type":"string"}},"required":["value"],"type":"object"},"TTPBehaviorAttackPatternSchema":{"properties":{"capec_id":{"type":"string"},"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"minLength":1,"type":"string"},"idref":{"minLength":1,"type":"string"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"title":{"type":"string"},"type":{"default":"attack-pattern","description":"Constant field, must have a value of \"attack-pattern\"","type":"string"}},"required":["type"],"type":"object"},"TTPBehaviorExploitSchema":{"properties":{"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"minLength":1,"type":"string"},"idref":{"minLength":1,"type":"string"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"title":{"type":"string"},"type":{"default":"exploit","description":"Constant field, must have a value of \"exploit\"","type":"string"}},"required":["type"],"type":"object"},"TTPBehaviorMalwareSchema":{"properties":{"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"minLength":1,"type":"string"},"idref":{"minLength":1,"type":"string"},"names":{"items":{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"},"type":"array"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"title":{"type":"string"},"type":{"default":"malware-instance","description":"Constant field, must have a value of \"malware-instance\"","type":"string"},"types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ControlledVocabularyStringSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ControlledVocabularyStringSchema","{http://stix.mitre.org/default_vocabularies-1}MalwareTypeVocab-1.0":"#/components/schemas/MalwareTypeVocabSchema1"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/MalwareTypeVocabSchema1"},{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}MalwareTypeVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"}},"required":["type"],"type":"object"},"TTPBehaviorSchema":{"properties":{"attack_patterns":{"items":{"$ref":"#/components/schemas/TTPBehaviorAttackPatternSchema"},"type":"array"},"exploits":{"items":{"$ref":"#/components/schemas/TTPBehaviorExploitSchema"},"type":"array"},"malware":{"items":{"$ref":"#/components/schemas/TTPBehaviorMalwareSchema"},"type":"array"},"type":{"default":"behavior","description":"Constant field, must have a value of \"behavior\"","type":"string"}},"required":["type"],"type":"object"},"TTPResourceInfrastructureSchema":{"properties":{"description":{"type":"string"},"description_structuring_format":{"type":"string"},"id":{"minLength":1,"type":"string"},"idref":{"minLength":1,"type":"string"},"short_description":{"type":"string"},"short_description_structuring_format":{"type":"string"},"title":{"type":"string"},"type":{"default":"infrastructure","description":"Constant field, must have a value of \"infrastructure\"","type":"string"},"types":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ControlledVocabularyStringSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ControlledVocabularyStringSchema","{http://stix.mitre.org/default_vocabularies-1}AttackerInfrastructureTypeVocab-1.0":"#/components/schemas/AttackerInfrastructureTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/AttackerInfrastructureTypeVocabSchema"},{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}AttackerInfrastructureTypeVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"}},"required":["type"],"type":"object"},"TTPResourceSchema":{"properties":{"infrastructure":{"$ref":"#/components/schemas/TTPResourceInfrastructureSchema"},"personas":{"items":{"$ref":"#/components/schemas/IdentitySchema"},"type":"array"},"tools":{"items":{"$ref":"#/components/schemas/AttackerToolInformationSchema"},"type":"array"},"type":{"default":"resource","description":"Constant field, must have a value of \"resource\"","type":"string"}},"required":["type"],"type":"object"},"TTPVictimTargetingSchema":{"properties":{"identity":{"$ref":"#/components/schemas/CIQIdentitySchema"},"targeted_information":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ControlledVocabularyStringSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ControlledVocabularyStringSchema","{http://stix.mitre.org/default_vocabularies-1}InformationTypeVocab-1.0":"#/components/schemas/InformationTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/InformationTypeVocabSchema"},{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}InformationTypeVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"targeted_systems":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"ControlledVocabularyStringSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/ControlledVocabularyStringSchema","{http://stix.mitre.org/default_vocabularies-1}SystemTypeVocab-1.0":"#/components/schemas/SystemTypeVocabSchema"},"propertyName":"vocab"},"oneOf":[{"$ref":"#/components/schemas/SystemTypeVocabSchema"},{"$ref":"#/components/schemas/ControlledVocabularyStringSchema"}],"properties":{"vocab":{"enum":["{http://stix.mitre.org/default_vocabularies-1}SystemTypeVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"type":{"default":"victim-targeting","description":"Constant field, must have a value of \"victim-targeting\"","type":"string"}},"required":["type"],"type":"object"},"TaskAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"is_active":{"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"parameters":{},"related_object":{"description":"URL of the object associated with this task. It can be a rule, a feed or an enricher.","example":"http://localhost/api/v2/entity_rules/1","format":"url","nullable":true,"readOnly":true,"type":"string"},"runs":{"description":"List containing the 10 most recent runs of this task","example":["http://localhost/api/v2/tasks/runs/1"],"items":{"description":"Task run ID/URL","example":"http://localhost/api/v2/tasks/runs/1","readOnly":true},"readOnly":true,"type":"array"},"type":{"readOnly":true,"type":"string"}},"required":["name"],"type":"object"},"TaskExecutionScheduleParametersSchema":{"properties":{"day_of_month":{"default":"*","description":"A cron field: `*`, `5`, `*/4`.","example":"*","type":"string"},"day_of_week":{"default":"*","description":"A cron field: `*`, `5`, `*/4`.","example":"*","type":"string"},"hour":{"default":"*","description":"A cron field: `*`, `5`, `*/4`.","example":"*","type":"string"},"minute":{"default":"0","description":"A cron field: `*`, `5`, `*/4`.","example":"*","type":"string"},"month_of_year":{"default":"*","description":"A cron field: `*`, `5`, `*/4`.","example":"*","type":"string"}},"type":"object"},"TaskExecutionScheduleSchema":{"properties":{"parameters":{"allOf":[{"$ref":"#/components/schemas/TaskExecutionScheduleParametersSchema"}],"description":"The schedule is automatically adjusted from the timezone to run accordingly on UTC on the server. This is only adjusted as long as no range, step or list is used in the `hour` and `minute` parts."},"timezone":{"description":"If not provided, the value is inferred in order from the user setting, system setting or UTC.","example":"Europe/Amsterdam","type":"string"},"type":{"enum":["cron"],"type":"string"}},"required":["parameters","type"],"type":"object"},"TaskGroupAPISchema":{"properties":{"id":{"format":"uuid","type":"string"},"task_runs":{"items":{"$ref":"#/components/schemas/TaskRunProgressAPISchema"},"type":"array"}},"required":["id"],"type":"object"},"TaskRunAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"group_id":{"format":"uuid","readOnly":true,"type":"string"},"id":{"format":"uuid","readOnly":true,"type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"parameters":{"nullable":true,"type":"object"},"result":{"nullable":true},"status":{"enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"readOnly":true,"type":"string"},"task":{"description":"URL of the associated task","example":"http://localhost/api/v2/tasks/1"},"triggered_by":{"description":"User that triggered the task","example":"http://localhost/api/v2/users/1","nullable":true,"readOnly":true}},"required":["id"],"type":"object"},"TaskRunGroupAPISchema":{"properties":{"id":{"format":"uuid","type":"string"},"runs_per_status":{"additionalProperties":{"type":"integer"},"readOnly":true,"type":"object"},"status":{"description":"The aggregated status of the whole group, if at least one run in the group is 'FAILURE'/'PENDING', the group status is 'FAILURE'/'PENDING', if all runs have a 'SUCCESS' status, the group status is 'SUCCESS'.","enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"type":"string"},"total_task_runs":{"type":"integer"}},"required":["id"],"type":"object"},"TaskRunProgressAPISchema":{"properties":{"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"id":{"format":"uuid","type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"parameters":{"nullable":true,"readOnly":true,"type":"object"},"progress_details":{"additionalProperties":{"enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"type":"string"},"nullable":true,"readOnly":true,"type":"object"},"progress_status":{"enum":["PENDING","SENT","STARTED","RETRY","FAILURE","REVOKED","CAP_REACHED","WARNING","SUCCESS"],"readOnly":true,"type":"string"},"result":{"nullable":true,"readOnly":true,"type":"object"},"task":{"description":"Task ID/URL","example":"http://localhost/api/v2/tasks/1","readOnly":true}},"required":["id","task"],"type":"object"},"TaxonomyNodeAPISchema":{"properties":{"children":{"description":"URLs of the children nodes","example":["http://localhost/api/v2/taxonomies/1"],"items":{"description":"Taxonomy ID, URL or path expressed as a lists of strings","example":"http://localhost/api/v2/taxonomies/1"},"type":"array"},"code":{"description":"The ``code`` of a taxonomy node is only used\n in the built-in Admiralty Code taxonomy.\n\n It expects a single character\n that corresponds to one of the two-letter\n Admiralty Code system.\n E.g., 'A' represents a source reliability of 'Completely reliable'.\n ","nullable":true,"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"description":{"nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"is_system_defined":{"description":"True if this is a system-defined taxonomy node (in such case this node cannot be edited/deleted)","nullable":true,"readOnly":true,"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"name":{"type":"string"},"parent":{"description":"URL of the parent node, or null if this is a root node","example":"http://localhost/api/v2/taxonomies/1","nullable":true}},"type":"object"},"TerminologyCustomizationSchema":{"properties":{"abbreviation":{"readOnly":true,"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"custom_plural":{"maxLength":50,"nullable":true,"pattern":"^[^<>\\[\\]{}\\/\\\\\\\"';:|?*^%$#@=+~]*$","type":"string"},"custom_singular":{"maxLength":50,"nullable":true,"pattern":"^[^<>\\[\\]{}\\/\\\\\\\"';:|?*^%$#@=+~]*$","type":"string"},"custom_starts_with_vowel":{"nullable":true,"type":"boolean"},"default_plural":{"readOnly":true,"type":"string"},"default_singular":{"readOnly":true,"type":"string"},"default_starts_with_vowel":{"readOnly":true,"type":"boolean"},"id":{"type":"integer"},"key":{"readOnly":true,"type":"string"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true}},"required":["id"],"type":"object"},"TermsItemSchema":{"properties":{"links":{"additionalProperties":{"$ref":"#/components/schemas/TermsLinkDetailSchema"},"nullable":true,"type":"object"},"text":{"type":"string"}},"required":["text"],"type":"object"},"TermsLinkDetailSchema":{"properties":{"external_link":{"type":"string"},"text":{"type":"string"}},"required":["external_link","text"],"type":"object"},"TermsSchema":{"properties":{"terms":{"items":{"$ref":"#/components/schemas/TermsItemSchema"},"readOnly":true,"type":"array"}},"type":"object"},"TestMechanismEfficacySchema":{"properties":{"type":{"default":"statement","description":"Constant field, must have a value of \"statement\"","type":"string"},"value":{"enum":["High","Low","Medium","None","Unknown"],"type":"string"}},"type":"object"},"TestMechanismRulesSchema":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"],"type":"object"},"TextStyleSchema":{"properties":{"font_color":{"nullable":true,"type":"string"},"font_family_id":{"type":"integer"},"id":{"type":"integer"},"meta":{"type":"object"},"type":{"enum":["titles_and_headings","paragraphs_and_links"],"type":"string"}},"required":["id"],"type":"object"},"ThreatActorRoleVocabSchema":{"properties":{"value":{"enum":["agent","director","independent","infrastructure-architect","infrastructure-operator","malware-author","sponsor"],"type":"string"},"vocab":{"default":"threat-actor-role-ov","description":"Constant field, must have a value of \"threat-actor-role-ov\"","type":"string"}},"required":["value"],"type":"object"},"ThreatActorSophisticationVocabSchema":{"properties":{"value":{"enum":["none","minimal","intermediate","advanced","expert","innovator","strategic"],"type":"string"},"vocab":{"default":"threat-actor-sophistication-ov","description":"Constant field, must have a value of \"threat-actor-sophistication-ov\"","type":"string"}},"required":["value"],"type":"object"},"ThreatActorTypeVocabSchema":{"properties":{"value":{"enum":["activist","competitor","crime-syndicate","criminal","hacker","insider-accidental","insider-disgruntled","nation-state","sensationalist","spy","terrorist","unknown"],"type":"string"},"vocab":{"default":"threat-actor-type-ov","description":"Constant field, must have a value of \"threat-actor-type-ov\"","type":"string"}},"required":["value"],"type":"object"},"TicketAPISchema":{"properties":{"assignee":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"comments":{"description":"[Collection of] Ticket comment ID/URL","example":["http://localhost/api/v2/tickets/comments/1"],"items":{"description":"Ticket comment ID/URL","example":"http://localhost/api/v2/tickets/comments/1","readOnly":true},"readOnly":true,"type":"array"},"created_at":{"format":"date-time","readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"description":{"nullable":true,"type":"string"},"done_at":{"format":"date-time","readOnly":true,"type":"string"},"due_date":{"format":"date","nullable":true,"type":"string"},"entities":{"description":"[Collection of] Entity ID/URL","example":["http://localhost/api/v2/entities/0c1e0600-187a-49b4-8bc4-a4323dbab780"],"items":{"description":"Entity ID/URL","example":"http://localhost/api/v2/entities/0c1e0600-187a-49b4-8bc4-a4323dbab780"},"type":"array"},"guidance":{"nullable":true,"type":"string"},"id":{"type":"integer"},"last_updated_at":{"format":"date-time","readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"stakeholders":{"description":"[Collection of] User ID/URL","example":["http://localhost/api/v2/users/1"],"items":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"type":"array"},"status":{"default":"OPEN","enum":["","OPEN","IN PROGRESS","DONE","CANCELLED"],"type":"string"},"workspaces":{"description":"[Collection of] Workspace ID/URL","example":["http://localhost/api/v2/workspaces/1"],"items":{"description":"Workspace ID/URL","example":"http://localhost/api/v2/workspaces/1"},"type":"array"}},"required":["name"],"type":"object"},"TicketCommentAPISchema":{"properties":{"created_at":{"format":"date-time","readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"id":{"type":"integer"},"last_updated_at":{"format":"date-time","readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"text":{"type":"string"},"ticket":{"description":"Ticket ID/URL","example":"http://localhost/api/v2/tickets/1"}},"required":["text"],"type":"object"},"TimeWindowSchema":{"properties":{"end":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"end_precision":{"enum":["day","hour","minute","month","second","year"],"type":"string"},"start":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"start_precision":{"enum":["day","hour","minute","month","second","year"],"type":"string"},"type":{"default":"valid-time","description":"Constant field, must have a value of \"valid-time\"","type":"string"}},"type":"object"},"TitleSchema":{"properties":{"is_enabled":{"type":"boolean"},"title":{"nullable":true,"type":"string"}},"type":"object"},"ToolInformationSchema":{"properties":{"description":{"type":"string"},"description_structuring_format":{"type":"string"},"hashes":{"items":{"description":"This object will be validated with a schema selected based on the value of the \"hash_type_vocab\" property. If the value doesn't match a specific schema or the property is missing, the schema named \"CyboxHashSchema\" will be used.","discriminator":{"mapping":{"*":"#/components/schemas/CyboxHashSchema","{http://cybox.mitre.org/default_vocabularies-2}HashNameVocab-1.0":"#/components/schemas/CyboxHashNameVocabSchema"},"propertyName":"hash_type_vocab"},"oneOf":[{"$ref":"#/components/schemas/CyboxHashNameVocabSchema"},{"$ref":"#/components/schemas/CyboxHashSchema"}],"properties":{"hash_type_vocab":{"enum":["{http://cybox.mitre.org/default_vocabularies-2}HashNameVocab-1.0","*"],"type":"string"}},"type":"object"},"type":"array"},"id":{"type":"string"},"idref":{"type":"string"},"name":{"type":"string"},"service_pack":{"type":"string"},"type":{"default":"tool-information","description":"Constant field, must have a value of \"tool-information\"","type":"string"},"types":{"items":{"$ref":"#/components/schemas/CyboxControlledVocabularySchema"},"type":"array"},"vendor":{"type":"string"},"version":{"type":"string"}},"required":["type"],"type":"object"},"ToolTypeVocabSchema":{"properties":{"value":{"enum":["denial-of-service","exploitation","information-gathering","network-capture","credential-exploitation","remote-access","vulnerability-scanning","unknown"],"type":"string"},"vocab":{"default":"tool-type-ov","description":"Constant field, must have a value of \"tool-type-ov\"","type":"string"}},"required":["value"],"type":"object"},"TranslationRequestSchema":{"properties":{"keep_html_formatting":{"description":"If translated text should keep the html tags.","type":"boolean"},"target_language":{"enum":["Albanian","Arabic","Bosnian","Bulgarian","Chinese(Simplified)","Chinese(Traditional)","Croatian","Czech","Danish","Dutch","English","Estonian","Farsi(Persian)","Finnish","French","German","Greek","Hebrew","Hindi","Hungarian","Icelandic","Italian","Japanese","Korean","Latvian","Lithuanian","Macedonian","Norwegian","Polish","Portuguese","Romanian","Russian","Serbian","Slovak","Slovenian","Spanish","Swedish","Turkish","Ukrainian"],"type":"string"},"text":{"description":"Translate provided text snippet.","minLength":1,"type":"string"}},"required":["keep_html_formatting","target_language","text"],"type":"object"},"TranslationResponseSchema":{"properties":{"output_text":{"type":"string"}},"type":"object"},"UploadedBlobAPISchema":{"properties":{"archive_password":{"type":"string"},"blob_id":{"readOnly":true,"type":"integer"},"category":{"enum":["malware-sandbox","manual","entity-extraction"],"type":"string"},"content_type":{"enum":["urn:spycloud.io:json:1.0","urn:spycloud.io:data-json:1.0","urn:eclecticiq.com:advanced-csv-entities:1.0"],"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"csv_mapping":{"description":"CSV Mapping linked to the uploaded blob","example":"http://localhost/api/v2/csv-mappings/1"},"csv_mapping_inline":{"$ref":"#/components/schemas/CSVMappingInlineSchema"},"filename":{"default":"untitled","type":"string"},"group_id":{"readOnly":true},"has_valid_signature":{"type":"boolean"},"id":{"type":"integer"},"information_source":{},"mime_type":{"type":"string"},"notification_metadata":{"description":"Details of the data included in the notification response.","type":"object"},"processing_details":{"readOnly":true},"processing_status":{"readOnly":true},"require_content_validation":{"type":"boolean"},"require_link_types":{"type":"boolean"},"size":{"readOnly":true,"type":"integer"},"source":{"description":"Source associated to this object. (ID/URL)","example":"http://localhost/api/v2/sources/f2131e00-a34d-45bc-8cef-77fe793c6e08"},"source_reliability":{"enum":["A","B","C","D","E","F",null],"nullable":true,"type":"string"},"tlp_color_override":{"description":"The values `CLEAR` and `AMBER_STRICT` are also accepted as an input but converted to TLP v1 on the response side.","enum":["NONE","WHITE","GREEN","AMBER","RED"],"nullable":true,"type":"string"}},"required":["content_type","source"],"type":"object"},"UserAPISchema":{"properties":{"activation_link":{"description":"This field is specified if the user has not been activated yet, and it is only visible to the user itself and to platform admins","format":"url","readOnly":true,"type":"string"},"created_at":{"description":"User creation date (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"default_source":{"description":"\nThe default source that will be attached when an entity is created by the user and no\nsource is provided. The default source can be manually defined else it will be the most\nrecent accessible source.\n\nIf the user has no accessible source, then `None` is returned. Only a source id of a\ngroup is accepted.\n","example":"http://localhost/api/v2/sources/ca9041c8-9c35-4f6e-877f-90d103e51f4b","nullable":true},"email":{"description":"User email address","example":"admin@localhost","type":"string"},"first_name":{"description":"User first name","type":"string"},"groups":{"description":"List of groups the user is subscribed to, together with the role. Possible values for roles: ['admin', 'member']","example":["http://localhost/api/v2/groups/1?role=member"],"items":{"description":"Group ID/URL associated to a group,together with its role. Possible values: ('member', 'admin'))","example":"http://localhost/api/v2/groups/1?role=member"},"type":"array"},"has_mfa_activated":{"description":"True if the user has multi-factor authentication enabled","readOnly":true,"type":"boolean"},"id":{"description":"User ID","readOnly":true,"type":"integer"},"is_admin":{"description":"The user is a platform admin. This flag can only be modified by other admin users","type":"boolean"},"last_name":{"description":"User last name","type":"string"},"last_updated_at":{"description":"User last update (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"password_last_updated_at":{"description":"When the user password was last updated (UTC ISO-8601 format)","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"permissions":{"description":"List of permissions associated to the user","example":["http://localhost/api/v2/permissions/1"],"items":{"description":"Permissions ID/URL","example":"http://localhost/api/v2/permissions/1","readOnly":true},"readOnly":true,"type":"array"},"roles":{"description":"List of roles associated to the user","example":["http://localhost/api/v2/roles/1"],"items":{"description":"Role ID/URL/name","example":"http://localhost/api/v2/roles/1"},"type":"array"},"sources":{"description":"[Collection of] List of sources the user is allowed to access.","example":["http://localhost/api/v2/sources/71980b87-87da-487a-ba02-0734fec178fc?allowed_tlp=RED"],"items":{"description":"List of sources the user is allowed to access.","example":"http://localhost/api/v2/sources/71980b87-87da-487a-ba02-0734fec178fc?allowed_tlp=RED","readOnly":true},"readOnly":true,"type":"array"},"status":{"description":"User status","enum":["inactive","locked","password reset requested","pending","active"],"type":"string"},"user_data":{"allOf":[{"$ref":"#/components/schemas/UserDataSchema"}],"description":"\n This object contains specific information related to the user.\n\n For storing custom data related to a user although any keys is accepted, there\n is some best-practice for forward compatibility if EIQ will reserve more keys.\n\n 1. Use root keys as little as possible, instead group the keys in a \"namespace\"\n key.\n 2. Prefer descriptive and non-generic names to avoid collision.\n ","nullable":true},"username":{"description":"User name","example":"admin","type":"string"}},"required":["id"],"type":"object"},"UserDataSchema":{"additionalProperties":true,"properties":{"dashboard":{"description":"Some internal settings used by the EIQ browser interface.","nullable":true},"default_values":{"allOf":[{"$ref":"#/components/schemas/DefaultValuesSchema"}],"description":"Some default values to be used when the user makes actions."},"theme":{"description":"The theme mode used by the EIQ browser interface.","enum":["auto","light","dark"],"type":"string"},"theme_variant":{"default":"dutch-blue","description":"The theme style used by the EIQ browser interface.","enum":["teal","lavender","dutch-blue","ruby-red"],"type":"string"},"view_states":{"description":"Some internal settings used by the EIQ browser interface."}},"type":"object"},"ValueRequiredSchema":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"],"type":"object"},"ValueSchema":{"properties":{"value":{"minLength":1,"type":"string"}},"type":"object"},"ValueSearchInSchema":{"properties":{"fields_to_search":{"description":"List of entity fields to search for a pattern. Supported: ['title', 'tags', 'description']","enum":["title","tags","description"],"items":{"type":"string"},"type":"array"}},"type":"object"},"VendorAPISchema":{"properties":{"category":{"enum":["ticketing","default"],"type":"string"},"description":{"type":"string"},"id":{"type":"integer"},"is_active":{"type":"boolean"},"name":{"readOnly":true,"type":"string"},"parameters":{},"slug":{"readOnly":true},"ui_form_schema":{"readOnly":true}},"required":["category","name"],"type":"object"},"VulnerabilitiesSchema":{"properties":{"affected_software":{"items":{"$ref":"#/components/schemas/ObservableSchema"},"type":"array"},"cve_id":{"type":"string"},"cvss_score":{"$ref":"#/components/schemas/CvssScoreSchema"},"description":{"type":"string"},"discovered_datetime":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"discovered_datetime_precision":{"type":"string"},"is_known":{"type":"boolean"},"is_publicly_acknowledged":{"type":"boolean"},"osvdb_id":{"minimum":1,"type":"integer"},"published_datetime":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"type":"string"},"published_datetime_precision":{"type":"string"},"references":{"items":{"format":"url","type":"string"},"type":"array"},"source":{"type":"string"},"title":{"type":"string"},"type":{"default":"vulnerability","description":"Constant field, must have a value of \"vulnerability\"","type":"string"}},"type":"object"},"WeaknessSchema":{"properties":{"cwe_id":{"type":"string"},"description":{"minLength":1,"type":"string"},"type":{"default":"weakness","description":"Constant field, must have a value of \"weakness\"","type":"string"}},"required":["description"],"type":"object"},"WebEnrichmentSourceSchema":{"properties":{"source_id":{"type":"string"},"source_link":{"type":"string"},"source_name":{"type":"string"}},"type":"object"},"WidgetAPISchema":{"properties":{"category":{"enum":["custom","entity","user","observable","dataset","group","role","system-job"],"type":"string"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"dashboards":{"description":"[Collection of] Dashboard ID/URL","example":["http://localhost/api/v2/dashboards/1"],"items":{"description":"Dashboard ID/URL","example":"http://localhost/api/v2/dashboards/1"},"type":"array"},"description":{"default":"","nullable":true,"type":"string"},"id":{"readOnly":true,"type":"integer"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"thumbnail_dark":{"format":"byte","nullable":true,"type":"string","writeOnly":true},"thumbnail_light":{"format":"byte","nullable":true,"type":"string","writeOnly":true},"widget_config":{"type":"object"},"widget_type":{"enum":["overview","information"],"type":"string"},"workspaces":{"description":"[Collection of] Workspace ID/URL","example":["http://localhost/api/v2/workspaces/1"],"items":{"description":"Workspace ID/URL","example":"http://localhost/api/v2/workspaces/1"},"type":"array"}},"required":["category","name","widget_config"],"type":"object"},"WorkspaceAPISchema":{"properties":{"all_collaborators":{"description":"List of all the collaborators of the workspace, including those associated through their groups","example":["http://localhost/api/v2/users/1"],"items":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"type":"array"},"analysis":{"type":"string"},"archived_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"collaborators":{"description":"List of users the workspace has been shared with. Does not include users in groups that the workspace has been shared with.","example":["http://localhost/api/v2/users/1"],"items":{"description":"User ID/URL","example":"http://localhost/api/v2/users/1"},"type":"array"},"comments":{"description":"List of workspace comments","example":["http://localhost/api/v2/workspaces/comments/1"],"items":{"description":"Workspace comment ID/URL","example":"http://localhost/api/v2/workspaces/comments/1","readOnly":true},"readOnly":true,"type":"array"},"created_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"created_by":{"description":"User that created this workspace","example":"http://localhost/api/v2/users/1","readOnly":true},"datasets":{"description":"List of datasets attached to the workspace. The `public` attribute is set to `True` if the workspace is listed as public and the dataset is visible to everyone.","example":["http://localhost/api/v2/datasets/1?public=True","http://localhost/api/v2/datasets/2?public=False","http://localhost/api/v2/datasets/3?public=True","http://localhost/api/v2/datasets/4?public=False"],"items":{"description":"Dataset ID/URL","example":"http://localhost/api/v2/datasets/1"},"type":"array"},"description":{"type":"string"},"discovery_tasks":{"description":"List of discovery rules associated with the workspace","example":["http://localhost/api/v2/tasks/1"],"items":{"description":"Discovery task ID/URL","example":"http://localhost/api/v2/tasks/1"},"type":"array"},"entities":{"description":"List of public entities attached to the workspace","example":["http://localhost/api/v2/entities/d290fe4d-2238-4376-83b6-2c1e19e9fecf"],"items":{"description":"Entity ID/URL","example":"http://localhost/api/v2/entities/d290fe4d-2238-4376-83b6-2c1e19e9fecf"},"type":"array"},"external_url":{"format":"url","readOnly":true,"type":"string"},"files":{"description":"List of files attached to the workspace","example":["http://localhost/api/v2/files/1?public=True","http://localhost/api/v2/files/2?public=False","http://localhost/api/v2/files/3?public=True","http://localhost/api/v2/files/4?public=False"],"items":{"description":"File ID/URL","example":"http://localhost/api/v2/files/1","readOnly":true},"readOnly":true,"type":"array"},"groups":{"description":"List of user groups the workspace has been shared with","example":["http://localhost/api/v2/groups/1"],"items":{"description":"Group ID/URL","example":"http://localhost/api/v2/groups/1"},"type":"array"},"id":{"readOnly":true,"type":"integer"},"is_archived":{"type":"boolean"},"is_public":{"description":"Set to `True` to make the workspace \"Listed\".\n\n \"Listed\" workspaces have\n their name, public description,\n and \"pinned\" (public) items visible\n to all users who have at least `read workspaces`\n permissions. Users still cannot modify\n these workspaces unless it has been\n shared with them.\n ","type":"boolean"},"is_shared_with_all":{"description":"Internal-only value.\n\n By default, this is set to `True` only\n for the default public workspace.\n\n This means the workspace can be accessed\n by all users with at least\n `read workspaces` permissions,\n and modified by all users with\n at least `modify workspaces` permissions.\n\n This workspace cannot be deleted.\n ","readOnly":true,"type":"boolean"},"last_updated_at":{"description":"Timestamp in UTC ISO-8601 format","example":"2016-12-31T16:28:00+00:00","nullable":true,"readOnly":true,"type":"string"},"last_updated_by":{"description":"User that last updated this workspace","example":"http://localhost/api/v2/users/1","readOnly":true},"name":{"type":"string"},"public_datasets":{"description":"List of public datasets attached to the workspace. Internal only - please favourusing `https://your-host/api/For example:\n`filter[code]='A'` retrieves the 'Admiralty Code -\nCompletely reliable' taxonomy node. `code` is case-\nsensitive.\n","in":"query","name":"filter[code]","schema":{"type":"string"}},{"description":"Filter system-defined taxonomies","in":"query","name":"filter[is_system_defined]","schema":{"type":"boolean"}}],"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"$ref":"#/components/schemas/TaxonomyNodeAPISchema"},"type":"array"}},"type":"object"}}},"description":"The requested object(s)"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"}},"security":[{"access-token":[]},{"jwt":[]}],"summary":"Get a list of taxonomies.","tags":["Taxonomies"],"x-eiq-permissions":["read taxonomies"]},"post":{"description":"Same as `PUT` for taxonomies endpoint. POST for taxonomies is also idempotent.\n\n**Required permissions**\n\n- `modify taxonomies`\n\n","requestBody":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"$ref":"#/components/schemas/TaxonomyNodeAPISchema"},"type":"array"}},"type":"object"}}}},"responses":{"200":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"$ref":"#/components/schemas/TaxonomyNodeAPISchema","description":"Success, with no change. All specified taxonomy nodes already exist."},"type":"array"}},"type":"object"}}},"description":"The requested object(s)"},"201":{"content":{"application/json":{"schema":{"properties":{"data":{"items":{"$ref":"#/components/schemas/TaxonomyNodeAPISchema","description":"Success. One or more taxonomy nodes are created."},"type":"array"}},"type":"object"}}},"description":"The created object"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}},"security":[{"access-token":[]},{"jwt":[]}],"summary":"Create taxonomy nodes by specifying a single node or a node path.","tags":["Taxonomies"],"x-eiq-permissions":["modify taxonomies"]},"put":{"description":"The taxonomy endpoint allows you to create:\n\n
- \n
- \n
\n
\nTaxonomy node names:\nTaxonomy node names must be unique for their parents.\n\n
\n\nCreate all the nodes along a taxonomy node\npath by sending a list of taxonomy nodes\nin these formats:\n\n
- \n
- \n