---
title: "Add event"
method: POST
path: "/events/add"
tags: ["Events"]
---

# Add event

`POST /events/add`

## Request body

- EventNoId
  - `org_id` string
  - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
  - `info` string
  - `orgc_id` string
  - `uuid` string, uuid
  - `date` string
  - `published` boolean
  - `analysis` '0' | '1' | '2' — Represents the analysis maturity level. * `0` - Initial * `1` - Ongoing * `2` - Complete
  - `attribute_count` string
  - `timestamp` string, nullable
  - `sharing_group_id` union
    - string, nullable
    - string, uuid, nullable
  - `proposal_email_lock` boolean
  - `locked` boolean
  - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined
  - `publish_timestamp` string
  - `sighting_timestamp` string
  - `disable_correlation` boolean
  - `extends_uuid` string, nullable
  - `event_creator_email` string, email

## Response `200`

A freshly created event

- EditedEvent
  - `Event` object
    - `id` string
    - `org_id` string
    - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
    - `info` string
    - `orgc_id` string
    - `uuid` string, uuid
    - `date` string
    - `published` boolean
    - `analysis` '0' | '1' | '2' — Represents the analysis maturity level. * `0` - Initial * `1` - Ongoing * `2` - Complete
    - `attribute_count` string
    - `timestamp` string, nullable
    - `sharing_group_id` union
      - string, nullable
      - string, uuid, nullable
    - `proposal_email_lock` boolean
    - `locked` boolean
    - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined
    - `publish_timestamp` string
    - `sighting_timestamp` string
    - `disable_correlation` boolean
    - `extends_uuid` string, nullable
    - `event_creator_email` string, email
    - `Feed` Feed
      - `id` string
      - `name` string
      - `provider` string
      - `url` string
      - `rules` string, nullable — Stringified JSON filter rules.
      - `enabled` boolean
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `tag_id` string
      - `default` boolean
      - `source_format` '1' | 'csv' | 'freetext' | 'misp'
      - `fixed_event` boolean — target_event option might be considered
      - `delta_merge` boolean — Merge attributes (only add new attribute, remove revoked attributes)
      - `event_id` string
      - `publish` boolean
      - `override_ids` boolean — The IDS flags will be set to Off for this feed
      - `settings` string, nullable
      - `input_source` 'local' | 'network' — Specify whether the source (url field) is a directory (local) or a genuine url (network).
      - `delete_local_file` boolean — The IDS flags will be set to Off for this feed
      - `lookup_visible` boolean — The lookup will not be visible in the feed correlation
      - `headers` string, nullable — Headers to be passed with the requests. All separated by
      - `caching_enabled` boolean — The feed is cached
      - `force_to_ids` boolean — The IDS flags will be set to On for this feed
      - `orgc_id` string
      - `cache_timestamp` union
        - string
        - boolean
    - `Org` EventOrganisation
      - `id` string
      - `name` string
      - `uuid` string, uuid
    - `Orgc` EventOrganisation
      - `id` string
      - `name` string
      - `uuid` string, uuid
    - `Attribute` Attribute[]
      - `id` string
      - `event_id` string
      - `object_id` string
      - `object_relation` string, nullable
      - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
      - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
      - `value` string
      - `to_ids` boolean
      - `uuid` string, uuid
      - `timestamp` string, nullable
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `comment` string
      - `deleted` boolean
      - `disable_correlation` boolean
      - `first_seen` union
        - string, nullable
        - string, date-time
      - `last_seen` union
        - string, nullable
        - string, date-time
      - `Tag` Tag[]
        - `id` string
        - `name` string
        - `colour` string
        - `exportable` boolean
        - `org_id` string
        - `user_id` string
        - `hide_tag` boolean
        - `numerical_value` string, nullable
        - `is_galaxy` boolean
        - `is_custom_galaxy` boolean
        - `inherited` integer
      - `Galaxy` Galaxy[]
        - `id` string
        - `uuid` string, uuid
        - `name` string
        - `type` string
        - `description` string
        - `version` string
        - `icon` string
        - `namespace` string
        - `kill_chain_order` object, nullable
    - `ShadowAttribute` Attribute[]
      - `id` string
      - `event_id` string
      - `object_id` string
      - `object_relation` string, nullable
      - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
      - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
      - `value` string
      - `to_ids` boolean
      - `uuid` string, uuid
      - `timestamp` string, nullable
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `comment` string
      - `deleted` boolean
      - `disable_correlation` boolean
      - `first_seen` union
        - string, nullable
        - string, date-time
      - `last_seen` union
        - string, nullable
        - string, date-time
      - `Tag` Tag[]
        - `id` string
        - `name` string
        - `colour` string
        - `exportable` boolean
        - `org_id` string
        - `user_id` string
        - `hide_tag` boolean
        - `numerical_value` string, nullable
        - `is_galaxy` boolean
        - `is_custom_galaxy` boolean
        - `inherited` integer
      - `Galaxy` Galaxy[]
        - `id` string
        - `uuid` string, uuid
        - `name` string
        - `type` string
        - `description` string
        - `version` string
        - `icon` string
        - `namespace` string
        - `kill_chain_order` object, nullable
    - `RelatedEvent` object[]
      - `Event` ExtendedEvent
        - `id` string
        - `org_id` string
        - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
        - `info` string
        - `orgc_id` string
        - `uuid` string, uuid
        - `date` string
        - `published` boolean
        - `analysis` '0' | '1' | '2' — Represents the analysis maturity level. * `0` - Initial * `1` - Ongoing * `2` - Complete
        - `attribute_count` string
        - `timestamp` string, nullable
        - `sharing_group_id` union
          - string, nullable
          - string, uuid, nullable
        - `proposal_email_lock` boolean
        - `locked` boolean
        - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined
        - `publish_timestamp` string
        - `sighting_timestamp` string
        - `disable_correlation` boolean
        - `extends_uuid` string, nullable
        - `event_creator_email` string, email
        - `Feed` Feed
          - `id` string
          - `name` string
          - `provider` string
          - `url` string
          - `rules` string, nullable — Stringified JSON filter rules.
          - `enabled` boolean
          - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
          - `sharing_group_id` union
            - string, nullable
            - string, uuid, nullable
          - `tag_id` string
          - `default` boolean
          - `source_format` '1' | 'csv' | 'freetext' | 'misp'
          - `fixed_event` boolean — target_event option might be considered
          - `delta_merge` boolean — Merge attributes (only add new attribute, remove revoked attributes)
          - `event_id` string
          - `publish` boolean
          - `override_ids` boolean — The IDS flags will be set to Off for this feed
          - `settings` string, nullable
          - `input_source` 'local' | 'network' — Specify whether the source (url field) is a directory (local) or a genuine url (network).
          - `delete_local_file` boolean — The IDS flags will be set to Off for this feed
          - `lookup_visible` boolean — The lookup will not be visible in the feed correlation
          - `headers` string, nullable — Headers to be passed with the requests. All separated by
          - `caching_enabled` boolean — The feed is cached
          - `force_to_ids` boolean — The IDS flags will be set to On for this feed
          - `orgc_id` string
          - `cache_timestamp` union
            - string
            - boolean
        - `Org` EventOrganisation
          - `id` string
          - `name` string
          - `uuid` string, uuid
        - `Orgc` EventOrganisation
          - `id` string
          - `name` string
          - `uuid` string, uuid
        - `Attribute` Attribute[]
          - `id` string
          - `event_id` string
          - `object_id` string
          - `object_relation` string, nullable
          - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
          - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
          - `value` string
          - `to_ids` boolean
          - `uuid` string, uuid
          - `timestamp` string, nullable
          - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
          - `sharing_group_id` union
            - string, nullable
            - string, uuid, nullable
          - `comment` string
          - `deleted` boolean
          - `disable_correlation` boolean
          - `first_seen` union
            - string, nullable
            - string, date-time
          - `last_seen` union
            - string, nullable
            - string, date-time
          - `Tag` Tag[]
            - `id` string
            - `name` string
            - `colour` string
            - `exportable` boolean
            - `org_id` string
            - `user_id` string
            - `hide_tag` boolean
            - `numerical_value` string, nullable
            - `is_galaxy` boolean
            - `is_custom_galaxy` boolean
            - `inherited` integer
          - `Galaxy` Galaxy[]
            - `id` string
            - `uuid` string, uuid
            - `name` string
            - `type` string
            - `description` string
            - `version` string
            - `icon` string
            - `namespace` string
            - `kill_chain_order` object, nullable
        - `ShadowAttribute` Attribute[]
          - `id` string
          - `event_id` string
          - `object_id` string
          - `object_relation` string, nullable
          - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
          - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
          - `value` string
          - `to_ids` boolean
          - `uuid` string, uuid
          - `timestamp` string, nullable
          - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
          - `sharing_group_id` union
            - string, nullable
            - string, uuid, nullable
          - `comment` string
          - `deleted` boolean
          - `disable_correlation` boolean
          - `first_seen` union
            - string, nullable
            - string, date-time
          - `last_seen` union
            - string, nullable
            - string, date-time
          - `Tag` Tag[]
            - `id` string
            - `name` string
            - `colour` string
            - `exportable` boolean
            - `org_id` string
            - `user_id` string
            - `hide_tag` boolean
            - `numerical_value` string, nullable
            - `is_galaxy` boolean
            - `is_custom_galaxy` boolean
            - `inherited` integer
          - `Galaxy` Galaxy[]
            - `id` string
            - `uuid` string, uuid
            - `name` string
            - `type` string
            - `description` string
            - `version` string
            - `icon` string
            - `namespace` string
            - `kill_chain_order` object, nullable
        - `RelatedEvent` object[]
          - `Event` ExtendedEvent — recursive
        - `Galaxy` Galaxy[]
          - `id` string
          - `uuid` string, uuid
          - `name` string
          - `type` string
          - `description` string
          - `version` string
          - `icon` string
          - `namespace` string
          - `kill_chain_order` object, nullable
        - `Object` Object[]
          - `id` string
          - `name` string
          - `meta-category` string
          - `description` string
          - `template_uuid` string, uuid
          - `template_version` string
          - `event_id` string
          - `uuid` string, uuid
          - `timestamp` string
          - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
          - `sharing_group_id` union
            - string, nullable
            - string, uuid, nullable
          - `comment` string
          - `deleted` boolean
          - `first_seen` union
            - string, nullable
            - string, date-time
          - `last_seen` union
            - string, nullable
            - string, date-time
          - `Attribute` Attribute[]
            - `id` string
            - `event_id` string
            - `object_id` string
            - `object_relation` string, nullable
            - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
            - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
            - `value` string
            - `to_ids` boolean
            - `uuid` string, uuid
            - `timestamp` string, nullable
            - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
            - `sharing_group_id` union
              - …
            - `comment` string
            - `deleted` boolean
            - `disable_correlation` boolean
            - `first_seen` union
              - …
            - `last_seen` union
              - …
            - `Tag` Tag[]
              - …
            - `Galaxy` Galaxy[]
              - …
        - `EventReport` EventReport[]
          - `id` string
          - `uuid` string, uuid
          - `event_id` string
          - `name` string
          - `content` string
          - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
          - `sharing_group_id` union
            - string, nullable
            - string, uuid, nullable
          - `timestamp` string, nullable
          - `deleted` boolean
        - `Tag` Tag[]
          - `id` string
          - `name` string
          - `colour` string
          - `exportable` boolean
          - `org_id` string
          - `user_id` string
          - `hide_tag` boolean
          - `numerical_value` string, nullable
          - `is_galaxy` boolean
          - `is_custom_galaxy` boolean
          - `inherited` integer
    - `Galaxy` Galaxy[]
      - `id` string
      - `uuid` string, uuid
      - `name` string
      - `type` string
      - `description` string
      - `version` string
      - `icon` string
      - `namespace` string
      - `kill_chain_order` object, nullable
    - `Object` Object[]
      - `id` string
      - `name` string
      - `meta-category` string
      - `description` string
      - `template_uuid` string, uuid
      - `template_version` string
      - `event_id` string
      - `uuid` string, uuid
      - `timestamp` string
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `comment` string
      - `deleted` boolean
      - `first_seen` union
        - string, nullable
        - string, date-time
      - `last_seen` union
        - string, nullable
        - string, date-time
      - `Attribute` Attribute[]
        - `id` string
        - `event_id` string
        - `object_id` string
        - `object_relation` string, nullable
        - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other'
        - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised'
        - `value` string
        - `to_ids` boolean
        - `uuid` string, uuid
        - `timestamp` string, nullable
        - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
        - `sharing_group_id` union
          - string, nullable
          - string, uuid, nullable
        - `comment` string
        - `deleted` boolean
        - `disable_correlation` boolean
        - `first_seen` union
          - string, nullable
          - string, date-time
        - `last_seen` union
          - string, nullable
          - string, date-time
        - `Tag` Tag[]
          - `id` string
          - `name` string
          - `colour` string
          - `exportable` boolean
          - `org_id` string
          - `user_id` string
          - `hide_tag` boolean
          - `numerical_value` string, nullable
          - `is_galaxy` boolean
          - `is_custom_galaxy` boolean
          - `inherited` integer
        - `Galaxy` Galaxy[]
          - `id` string
          - `uuid` string, uuid
          - `name` string
          - `type` string
          - `description` string
          - `version` string
          - `icon` string
          - `namespace` string
          - `kill_chain_order` object, nullable
    - `EventReport` EventReport[]
      - `id` string
      - `uuid` string, uuid
      - `event_id` string
      - `name` string
      - `content` string
      - `distribution` '0' | '1' | '2' | '3' | '4' | '5' — Who will be able to see this event once it becomes published and eventually when it becomes pulled: * `0` - Your organization only * `1` - This community only * `2` - Connected communities * `3` - All communities * `4` - Sharing group * `5` - Inherit Event
      - `sharing_group_id` union
        - string, nullable
        - string, uuid, nullable
      - `timestamp` string, nullable
      - `deleted` boolean
    - `Tag` Tag[]
      - `id` string
      - `name` string
      - `colour` string
      - `exportable` boolean
      - `org_id` string
      - `user_id` string
      - `hide_tag` boolean
      - `numerical_value` string, nullable
      - `is_galaxy` boolean
      - `is_custom_galaxy` boolean
      - `inherited` integer

## Other responses

- `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.
- `default` — Unexpected API error

---

[API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)