v1

latestSwagger 2.02026-08-0484141342.3 KB

Threats

# CreateAction

Creates custom actions with given arguments

post/v1/threat-library/actions

Request body

action_resultstring

affected_osstring[]

affected_platform_idsinteger[]

attack_modulestring

categorystring

descriptionstring

is_privilegedboolean

is_sensitive_contentboolean

keywordstring

namestring

process_resultstring

remote_file_idsinteger[]

Remote file ids (from the file upload endpoint) to attach to the action

sourcesstring[]

tactic_idinteger

tagsstring[]

technique_idinteger

titlestring

in: body

ukc_phase_idinteger

urlstring

in: body

url_categorystring

use_casestring

Example request

{
  "action_result": "unblocked",
  "affected_os": [
    "Windows"
  ],
  "affected_platform_ids": [
    1
  ],
  "attack_module": "Endpoint Scenario",
  "category": "Attack Scenario",
  "description": "Stops the Defender service using sc.exe",
  "keyword": "\"((\\\"process_name\\\" AND \\\"argument\\\") OR (\\\"log_source\\\")) AND NOT ((\\\"PICUS_REWIND\\\") OR (\\\"File created:\\\" AND (\\\"Scenarios\\\" OR \\\"Simulation\\\")))\"",
  "name": "Stop Windows Defender service",
  "process_result": "P1",
  "remote_file_ids": [
    1000001
  ],
  "sources": [
    "EDR"
  ],
  "tactic_id": 6,
  "tags": [
    "APT 10"
  ],
  "technique_id": 25,
  "ukc_phase_id": 7,
  "url_category": "Ads",
  "use_case": "Sensitive Data Exposure"
}

Response

ActionCreateReturnResponse