--- title: "Create Group" method: POST path: "/v3/groups" tags: ["Groups"] --- # Create Group `POST /v3/groups` Allows the creation of a new Group ## Query parameters - `fields` string[] - `createActivityLog` string ## Request body - Group - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityVictimAttributeData - `data` VictimAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - `id` integer - `name` string, required - `path` string, required - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - `relationship` string - `indicator` Indicator — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `indicatorId` integer, required - `indicator` Indicator — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - … - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - `id` integer - `fullRecord` string, required - `registrant` string - `created` string, date-time - `updated` string, date-time - `expires` string, date-time - `contacts` Contact[] - `id` integer - `type` string - `name` string - `organization` string - `street1` string - `street2` string - `city` string - `state` string - `postalCode` string - `country` string - `phone` string - `email` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - `id` integer - `addresses` ListEntityIndicator — recursive - `host` Indicator — recursive - `dateOccurred` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - `type` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - `id` integer - `type` string, required - `victimId` integer, required - `address` string - `addressType` string - `accountName` string - `socialNetwork` string - `networkType` string - `website` string - `phone` string - `webLink` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `xid` string - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `workflowPhase` integer - `workflowStep` integer - `dueDate` string, date-time - `required` boolean - `dependentOnId` integer - `status` string - `completedBy` string - `completedDate` string, date-time - `duration` integer - `assignee` Assignee - `id` integer - `type` string, required - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `durationType` string - `owner` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `eventDate` string, date-time - `dateAdded` string, date-time - `summary` string, required - `deleted` boolean - `deletedReason` string - `systemGenerated` boolean - `link` string - `linkText` string - `user` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - `id` integer - `type` string, required - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `caseId` integer, required - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - `id` integer - `summary` string - `link` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact — recursive - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - … truncated; see the full OpenAPI document linked below ## Response `200` The new Group - Group - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityVictimAttributeData - `data` VictimAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - `id` integer - `name` string, required - `path` string, required - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - `relationship` string - `indicator` Indicator — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `indicatorId` integer, required - `indicator` Indicator — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - … - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - `id` integer - `fullRecord` string, required - `registrant` string - `created` string, date-time - `updated` string, date-time - `expires` string, date-time - `contacts` Contact[] - `id` integer - `type` string - `name` string - `organization` string - `street1` string - `street2` string - `city` string - `state` string - `postalCode` string - `country` string - `phone` string - `email` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - `id` integer - `addresses` ListEntityIndicator — recursive - `host` Indicator — recursive - `dateOccurred` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - `type` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - `id` integer - `type` string, required - `victimId` integer, required - `address` string - `addressType` string - `accountName` string - `socialNetwork` string - `networkType` string - `website` string - `phone` string - `webLink` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `xid` string - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `workflowPhase` integer - `workflowStep` integer - `dueDate` string, date-time - `required` boolean - `dependentOnId` integer - `status` string - `completedBy` string - `completedDate` string, date-time - `duration` integer - `assignee` Assignee - `id` integer - `type` string, required - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `durationType` string - `owner` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `eventDate` string, date-time - `dateAdded` string, date-time - `summary` string, required - `deleted` boolean - `deletedReason` string - `systemGenerated` boolean - `link` string - `linkText` string - `user` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `notes` ListEntityNote - `data` Note[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - `id` integer - `type` string, required - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `caseId` integer, required - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - `id` integer - `summary` string - `link` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator — recursive - `fileActions` ListEntityFileAction - `data` FileAction[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact — recursive - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - … truncated; see the full OpenAPI document linked below --- [API](https://skmtc.net/threatconnect/apis/threatconnect-api.md) · [All operations](https://skmtc.net/threatconnect/apis/threatconnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/threatconnect/threatconnect-api/revisions/730b8a350ae7/schema)