--- title: "Update IndicatorAttribute by ID" method: PUT path: "/v3/indicatorAttributes/{uniqueId}" tags: ["Indicator Attributes"] --- # Update IndicatorAttribute by ID `PUT /v3/indicatorAttributes/{uniqueId}` Allows the updating of an existing IndicatorAttribute ## Path parameters - `uniqueId` '1' | '2' | '3', required — param ID of the IndicatorAttribute that needs to be updated ## Query parameters - `fields` string[] - `createActivityLog` string ## Request body - IndicatorAttributeData - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityVictimAttributeData - `data` VictimAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `indicatorId` integer, required - `indicator` Indicator - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - … - `attributes` ListEntityVictimAttributeData - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - `id` integer - `name` string, required - `path` string, required - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - … - `attributes` ListEntityAttributeData - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - … - `platforms` ListEntityString - … - `securityCoverage` AttackSecurityCoverage - … - `financialImpact` AttackFinancialImpact - … - `normalized` boolean - `synonymousTagNames` ListEntityString - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - `id` integer - `type` string, required - `victimId` integer, required - `address` string - `addressType` string - `accountName` string - `socialNetwork` string - `networkType` string - `website` string - `phone` string - `webLink` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - … - `caseCloseUser` User - … - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - … - `caseDetectionTime` string, date-time - `caseDetectionUser` User - … - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - … - `tasks` ListEntityTask - … - `artifacts` ListEntityArtifact - … - `tags` ListEntityTag - … - `notes` ListEntityNote - … - `workflowEvents` ListEntityWorkflowEvent - … - `userAccess` ListEntityUser - … - `createdBy` User - … - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - … - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - … - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - … - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - … - `links` ListEntityLink - … - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `groupId` integer, required - `group` Group — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `reviews` ListEntityIntelligenceReview - `data` IntelligenceReview[] - `id` integer - `rating` integer - `dateAdded` string, date-time - `lastModified` string, date-time - `createdBy` User - … - `comments` string - `editable` boolean - `deletable` boolean - `reviewHelpful` boolean - `groupId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `handles` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `urls` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `customAiContent` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - `data` TaskAssignee[] - `id` integer - `type` string, required - `dateAdded` string, date-time - `user` User, required - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `legacyLink` string - `commonGroup` CommonGroup - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `subtype` string, required - `name` string, required - `summary` string - `description` string - `source` string - `sourceURLs` string[] - `external` boolean - `lastModified` string, date-time - `linkedGroups` ListEntityGroup — recursive - `references` ListEntityCommonGroupSource - `data` CommonGroupSource[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `cwes` ListEntityCommonGroupSource - `data` CommonGroupSource[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `customAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `mitreAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileActions` ListEntityFileAction - `data` FileAction[] - `relationship` string - `indicator` Indicator — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `xid` string - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `workflowPhase` integer - `workflowStep` integer - `dueDate` string, date-time - `required` boolean - `dependentOnId` integer - `status` string - `completedBy` string - `completedDate` string, date-time - `duration` integer - `assignee` Assignee - … - `notes` ListEntityNote - … - `artifacts` ListEntityArtifact - … - `durationType` string - `owner` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - … - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - … - `links` ListEntityLink - … - `associatedGroups` ListEntityGroup - … - `associatedIndicators` ListEntityIndicator - … - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - … - `platforms` ListEntityString - … - `securityCoverage` AttackSecurityCoverage - … - `financialImpact` AttackFinancialImpact - … - `normalized` boolean - `synonymousTagNames` ListEntityString - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `eventDate` string, date-time - `dateAdded` string, date-time - `summary` string, required - `deleted` boolean - `deletedReason` string - `systemGenerated` boolean - `link` string - `linkText` string - `user` User - … - `notes` ListEntityNote - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - `id` integer - `type` string, required - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `caseId` integer, required - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `type` string, required - `xid` string - `name` string, required - `createdBy` User - … - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedVictimAssets` ListEntityVictimAsset - … - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase — recursive - `associatedArtifacts` ListEntityArtifact - … - `attributes` ListEntityGroupAttributeData - … - `reviews` ListEntityIntelligenceReview - … - `handles` ListEntityAdversaryAsset - … - `urls` ListEntityAdversaryAsset - … - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - … - `customAiContent` AiInsights - … - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - … - `legacyLink` string - `commonGroup` CommonGroup - … - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - `id` integer - `summary` string - `link` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `type` string, required - `xid` string - `name` string, required - `createdBy` User - … - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedVictimAssets` ListEntityVictimAsset - … - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - … - `associatedArtifacts` ListEntityArtifact — recursive - `attributes` ListEntityGroupAttributeData - … - `reviews` ListEntityIntelligenceReview - … - `handles` ListEntityAdversaryAsset - … - `urls` ListEntityAdversaryAsset - … - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - … - `customAiContent` AiInsights - … - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - … - `legacyLink` string - `commonGroup` CommonGroup - … - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - `id` integer - `fullRecord` string, required - `registrant` string - `created` string, date-time - `updated` string, date-time - `expires` string, date-time - `contacts` Contact[] - `id` integer - `type` string - `name` string - `organization` string - `street1` string - `street2` string - `city` string - `state` string - `postalCode` string - `country` string - `phone` string - `email` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - `id` integer - `addresses` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `host` Indicator — recursive - `dateOccurred` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - `type` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `pinned` boolean - `default` boolean ## Response `200` The updated IndicatorAttribute - IndicatorAttributeData - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - `data` VictimAsset[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityVictimAttributeData - `data` VictimAttributeData[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string - `value` string, required - `source` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `lastModified` string, date-time - `settings` AttributeSettings - `id` integer - `owner` string - `associable` boolean - `pinnedByDefault` boolean - `message` string - `default` boolean - `shardId` integer - `ownerId` integer - `indicatorId` integer, required - `indicator` Indicator - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - `data` Victim[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `name` string, required - `description` string - `org` string - `suborg` string - `workLocation` string - `nationality` string - `assets` ListEntityVictimAsset - … - `attributes` ListEntityVictimAttributeData - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityAttributeData - `data` AttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel — recursive - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `platforms` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `securityCoverage` AttackSecurityCoverage - `id` integer - `value` string - `financialImpact` AttackFinancialImpact - `id` integer - `risk` string - `lastUpdated` string, date-time - `normalized` boolean - `synonymousTagNames` ListEntityString - `data` string[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `lastModified` string, date-time - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `firstSeen` string, date-time - `lastSeen` string, date-time - `rating` number - `confidence` integer - `threatAssessRating` number, double - `threatAssessConfidence` number, double - `threatAssessScore` integer - `threatAssessScoreObserved` integer - `threatAssessScoreFalsePositive` integer - `calScore` integer - `source` string - `description` string - `summary` string - `observations` integer - `lastObserved` string, date-time - `falsePositives` integer - `lastFalsePositive` string, date-time - `falsePositiveReportedByUser` boolean - `falsePositiveFlag` boolean - `trackedUsers` object - `privateFlag` boolean - `active` boolean - `activeLocked` boolean - `value1` string - `value2` string - `value3` string - `flag1` boolean - `flag2` boolean - `flag3` boolean - `intValue1` integer - `intValue2` integer - `intValue3` integer - `investigationLinks` ListEntityInvestigationLink - `data` InvestigationLink[] - `id` integer - `name` string, required - `path` string, required - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - `id` integer - `name` string, required - `description` string - `color` string - `owner` string - `dateAdded` string, date-time - `victims` ListEntityVictim - … - `attributes` ListEntityAttributeData - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - … - `platforms` ListEntityString - … - `securityCoverage` AttackSecurityCoverage - … - `financialImpact` AttackFinancialImpact - … - `normalized` boolean - `synonymousTagNames` ListEntityString - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `xid` string - `name` string, required - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedVictimAssets` ListEntityVictimAsset - `data` VictimAsset[] - `id` integer - `type` string, required - `victimId` integer, required - `address` string - `addressType` string - `accountName` string - `socialNetwork` string - `networkType` string - `website` string - `phone` string - `webLink` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - … - `caseCloseUser` User - … - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - … - `caseDetectionTime` string, date-time - `caseDetectionUser` User - … - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - … - `tasks` ListEntityTask - … - `artifacts` ListEntityArtifact - … - `tags` ListEntityTag - … - `notes` ListEntityNote - … - `workflowEvents` ListEntityWorkflowEvent - … - `userAccess` ListEntityUser - … - `createdBy` User - … - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - … - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - … - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - … - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - … - `links` ListEntityLink - … - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityGroupAttributeData - `data` GroupAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `groupId` integer, required - `group` Group — recursive - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `reviews` ListEntityIntelligenceReview - `data` IntelligenceReview[] - `id` integer - `rating` integer - `dateAdded` string, date-time - `lastModified` string, date-time - `createdBy` User - … - `comments` string - `editable` boolean - `deletable` boolean - `reviewHelpful` boolean - `groupId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `handles` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `urls` ListEntityAdversaryAsset - `data` AdversaryAsset[] - `id` integer - `name` string - `type` string - `webLink` string - `phoneNumber` string - `handle` string - `url` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `customAiContent` AiInsights - `id` integer - `summary` string - `app` string - `aiProvider` string - `markdown` string - `bullets` string[] - `lastRetrievalDate` string, date-time - `generatedBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - `data` TaskAssignee[] - `id` integer - `type` string, required - `dateAdded` string, date-time - `user` User, required - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `legacyLink` string - `commonGroup` CommonGroup - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - `data` SecurityLabel[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - `data` Tag[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `type` string, required - `subtype` string, required - `name` string, required - `summary` string - `description` string - `source` string - `sourceURLs` string[] - `external` boolean - `lastModified` string, date-time - `linkedGroups` ListEntityGroup — recursive - `references` ListEntityCommonGroupSource - `data` CommonGroupSource[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `cwes` ListEntityCommonGroupSource - `data` CommonGroupSource[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `customAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `mitreAliases` ListEntityCommonGroupAlias - `data` CommonGroupAlias[] - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileActions` ListEntityFileAction - `data` FileAction[] - `relationship` string - `indicator` Indicator — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrences` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `attributes` ListEntityIndicatorAttributeData - `data` IndicatorAttributeData[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase - `data` Case[] - `id` integer - `xid` string - `name` string, required - `description` string - `dateAdded` string, date-time - `lastUpdated` string, date-time - `caseOpenTime` string, date-time - `caseCloseTime` string, date-time - `caseOpenUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseCloseUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseOccurrenceTime` string, date-time - `caseOccurrenceUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `caseDetectionTime` string, date-time - `caseDetectionUser` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `detectionDue` string, date-time - `timeToDetect` integer - `detectionOverdue` boolean - `responseDue` string, date-time - `timeToRespond` integer - `responseOverdue` boolean - `status` string, required - `severity` string, required - `resolution` string - `assignee` Assignee - `id` integer - `type` string, required - `tasks` ListEntityTask - `data` Task[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `xid` string - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `workflowPhase` integer - `workflowStep` integer - `dueDate` string, date-time - `required` boolean - `dependentOnId` integer - `status` string - `completedBy` string - `completedDate` string, date-time - `duration` integer - `assignee` Assignee - … - `notes` ListEntityNote - … - `artifacts` ListEntityArtifact - … - `durationType` string - `owner` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `artifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - … - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - … - `links` ListEntityLink - … - `associatedGroups` ListEntityGroup - … - `associatedIndicators` ListEntityIndicator - … - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `tags` ListEntityTag - `data` Tag[] - `id` integer - `name` string, required - `owner` string - `description` string - `lastUsed` string, date-time - `techniqueId` string - `tactics` ListEntityString - … - `platforms` ListEntityString - … - `securityCoverage` AttackSecurityCoverage - … - `financialImpact` AttackFinancialImpact - … - `normalized` boolean - `synonymousTagNames` ListEntityString - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `workflowEvents` ListEntityWorkflowEvent - `data` WorkflowEvent[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `eventDate` string, date-time - `dateAdded` string, date-time - `summary` string, required - `deleted` boolean - `deletedReason` string - `systemGenerated` boolean - `link` string - `linkText` string - `user` User - … - `notes` ListEntityNote - … - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `userAccess` ListEntityUser - `data` User[] - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `createdBy` User - `id` integer - `userName` string - `firstName` string - `lastName` string - `pseudonym` string - `owner` string - `password` string - `lastLogin` string, date-time - `lastPasswordChange` string, date-time - `uiTheme` string - `jobFunction` string - `jobRole` string - `termsAccepted` boolean - `termsAcceptedDate` string, date-time - `logoutIntervalMinutes` integer - `tqlTimeout` integer - `systemRole` string - `ownerRoles` object - `disabled` boolean - `locked` boolean - `passwordResetRequired` boolean - `twoFactorResetRequired` boolean - `customTqlTimeout` integer - `owner` string - `ownerId` integer - `workflowTemplate` WorkflowTemplate - `id` integer - `name` string, required - `description` string - `configTask` JsonNode - `configPlaybook` string - `configArtifact` string - `active` boolean - `version` integer - `cases` ListEntityCase — recursive - `assignee` Assignee - `id` integer - `type` string, required - `configAttribute` JsonNode - `owner` string - `ownerId` integer - `caseList` ListEntityCase — recursive - `related` ListEntityCase — recursive - `relationship` string - `attributes` ListEntityCaseAttributeData - `data` CaseAttributeData[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `type` string - `value` string, required - `source` string - `createdBy` User - … - `lastModified` string, date-time - `settings` AttributeSettings - … - `shardId` integer - `ownerId` integer - `caseId` integer, required - `pinned` boolean - `default` boolean - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `type` string, required - `xid` string - `name` string, required - `createdBy` User - … - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedVictimAssets` ListEntityVictimAsset - … - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase — recursive - `associatedArtifacts` ListEntityArtifact - … - `attributes` ListEntityGroupAttributeData - … - `reviews` ListEntityIntelligenceReview - … - `handles` ListEntityAdversaryAsset - … - `urls` ListEntityAdversaryAsset - … - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - … - `customAiContent` AiInsights - … - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - … - `legacyLink` string - `commonGroup` CommonGroup - … - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedCases` ListEntityCase — recursive - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedArtifacts` ListEntityArtifact - `data` Artifact[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `summary` string, required - `type` string, required - `fieldName` string - `artifactType` ArtifactType - `id` integer - `name` string - `description` string - `dataType` string - `intelType` string - `derivedLink` boolean - `intelType` string - `fileData` string - `source` string - `dateAdded` string, date-time - `analyticsType` string - `analyticsScore` integer - `analyticsPriority` string - `analyticsPriorityLevel` integer - `analyticsStatus` string - `taskId` integer - `taskXid` string - `notes` ListEntityNote - `data` Note[] - `id` integer - `caseId` integer, required - `caseXid` string, required - `text` string, required - `summary` string - `author` string - `dateAdded` string, date-time - `lastModified` string, date-time - `edited` boolean - `taskId` integer - `taskXid` string - `artifactId` integer - `workflowEventId` integer - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `links` ListEntityLink - `data` Link[] - `id` integer - `summary` string - `link` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedGroups` ListEntityGroup - `data` Group[] - `id` integer - `dateAdded` string, date-time - `securityLabels` ListEntitySecurityLabel - … - `ownerId` integer - `ownerName` string - `webLink` string - `tags` ListEntityTag - … - `type` string, required - `xid` string - `name` string, required - `createdBy` User - … - `upVote` boolean - `upVoteCount` string - `downVoteCount` string - `generatedReport` boolean - `associatedGroups` ListEntityGroup — recursive - `associatedIndicators` ListEntityIndicator - … - `associatedVictimAssets` ListEntityVictimAsset - … - `externalDateAdded` string, date-time - `externalLastModified` string, date-time - `externalDateExpires` string, date-time - `associatedCases` ListEntityCase - … - `associatedArtifacts` ListEntityArtifact — recursive - `attributes` ListEntityGroupAttributeData - … - `reviews` ListEntityIntelligenceReview - … - `handles` ListEntityAdversaryAsset - … - `urls` ListEntityAdversaryAsset - … - `fileName` string - `fileSize` integer - `status` string - `malware` boolean - `password` string - `documentType` string - `insights` AiInsights - … - `customAiContent` AiInsights - … - `documentDateAdded` string, date-time - `to` string - `from` string - `subject` string - `score` integer - `header` string - `body` string - `scoreIncludesBody` boolean - `emailDate` string, date-time - `scoreBreakdown` string - `eventType` string - `fileType` string - `fileText` string - `signatureDateAdded` string, date-time - `escalated` boolean - `reminded` boolean - `overdue` boolean - `dueDate` string, date-time - `reminderDate` string, date-time - `escalationDate` string, date-time - `lastModified` string, date-time - `assignments` ListEntityTaskAssignee - … - `legacyLink` string - `commonGroup` CommonGroup - … - `firstSeen` string, date-time - `lastSeen` string, date-time - `eventDate` string, date-time - `publishDate` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `associatedIndicators` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `derivedLink` boolean - `hashCode` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `address` string - `md5` string - `sha1` string - `sha256` string - `size` integer - `mode` string - `ip` string - `hostName` string - `dnsActive` boolean - `whoisActive` boolean - `whois` ListEntityWhoIs - `data` WhoIs[] - `id` integer - `fullRecord` string, required - `registrant` string - `created` string, date-time - `updated` string, date-time - `expires` string, date-time - `contacts` Contact[] - `id` integer - `type` string - `name` string - `organization` string - `street1` string - `street2` string - `city` string - `state` string - `postalCode` string - `country` string - `phone` string - `email` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `geoLocation` GeoLocation - `id` integer - `country` string - `countryCode` string - `state` string - `timezone` string - `city` string - `asn` integer - `registeringOrg` string - `lat` number, double - `lon` number, double - `dnsResolution` ListEntityDNSResolution - `data` DNSResolution[] - `id` integer - `addresses` ListEntityIndicator - `data` Indicator[] - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `host` Indicator — recursive - `dateOccurred` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `text` string - `legacyLink` string - `enrichment` ListEntityAbstractEnrichment - `data` AbstractEnrichment[] - `type` string - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `fileOccurrence` ListEntityFileOccurrence - `data` FileOccurrence[] - `id` integer - `fileName` string, required - `path` string, required - `date` string, date-time - `count` integer - `countSuccess` integer - `countFailure` integer - `count_type` string - `next` string - `prev` string - `mode` string - `pinned` boolean - `default` boolean --- [API](https://skmtc.net/threatconnect/apis/threatconnect-api.md) · [All operations](https://skmtc.net/threatconnect/apis/threatconnect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/threatconnect/threatconnect-api/versions/730b8a350ae7/schema)