--- title: "Add sightings of a list of values" method: POST path: "/sightings/add" tags: ["Sightings"] --- # Add sightings of a list of values `POST /sightings/add` ## Request body - object - `values` AttributeValue[] - `timestamp` string, nullable - `filters` AttributeRestSearchFilter - `page` integer, nullable - `limit` integer, nullable — Maximum number of results to be returned. Can't be greater than the one set for your role. 0 means maximum. - `value` string - `value1` string - `value2` string - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'suricata' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'edge-extension-id' | 'cortex' | 'boolean' | 'anonymised' - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other' - `org` union - string - string - `tags` string[], nullable - `searchall` string — Search events by matching any tag names, event descriptions, attribute values or attribute comments - `from` string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.) - `to` string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.) - `last` union — Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp - integer - string - `eventid` string - `withAttachments` boolean — Extends the response with the base64 representation of the attachment, if there is one - `uuid` string, uuid - `publish_timestamp` string - `published` boolean - `timestamp` string - `attribute_timestamp` string - `enforceWarninglist` boolean, nullable — Should the warning list be enforced. Adds blocked field for matching attributes - `to_ids` boolean, nullable - `deleted` boolean — Whether to include soft-deleted attributes. Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1], both deleted and non-deleted attributes will be returned. - `event_timestamp` string - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined - `eventinfo` string — Quick event description - `sharinggroup` string[], nullable — Sharing group ID(s), either as single string or list of IDs - `decayingModel` string — Specify the decaying model from which the decaying score should be calculated - `score` string — An alias to override on-the-fly the threshold of the decaying model - `first_seen` string — Seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m) - `last_seen` string — Seen within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m) - `includeEventUuid` boolean — Include matching eventUuids in the response - `includeEventTags` boolean — Include tags of matching events in the response - `includeProposals` boolean — Include proposals of matching events in the response - `requested_attributes` string[] — List of properties that will be selected in the CSV export - `includeContext` boolean, nullable — Adds events context fields in the CSV export - `headerless` boolean, nullable — Removes header in the CSV export - `includeWarninglistHits` boolean, nullable - `attackGalaxy` string, nullable - `object_relation` string, nullable — Filter by the attribute object relation value - `includeSightings` boolean, nullable — Extend response with Sightings DB results if the module is enabled - `includeCorrelations` boolean, nullable - `modelOverrides` ModelOverridesRestSearchFilter - `lifetime` number, float - `decay_speed` number, float - `threshold` number, float - `default_base_score` number, float - `base_score_config` object - `includeDecayScore` boolean — Include all enabled decaying score - `includeFullModel` boolean — Include all model information of matching events in the response - `excludeDecayed` boolean — Should the decayed elements by excluded - `returnFormat` 'json' | 'xml' | 'csv' | 'text' | 'stix' | 'stix2' | 'stix-json' | 'hashes' | 'cache' | 'count' | 'netfilter' | 'opendata' | 'openioc' | 'rpz' | 'snort' | 'suricata' | 'text' | 'yara' | 'yara-json' — Format of the response payload ## Response `200` Add sighting response - Sighting - `id` string - `attribute_id` string - `event_id` string - `org_id` string - `date_sighting` string - `uuid` string, uuid - `source` string - `type` string - `attribute_uuid` string, uuid - `Organisation` object - `id` string - `uuid` string, uuid - `name` string ## Other responses - `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header. - `404` — The specified resource was not found - `default` — Unexpected API error --- [API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)