You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`history`|`array`|Ordered list of modifications made to the alert (status changes, field updates, assignments, etc.).|
1026
1026
|`is_incident`|`boolean`||
1027
-
|`assets`|`array`||
1028
-
|`countermeasures`|`array`||
1029
-
|`updated_at`|`integer`||
1030
-
|`comments`|`array`||
1031
-
|`ttps`|`array`||
1032
-
|`number_of_unseen_comments`|`integer`||
1033
-
|`status`|`object`||
1027
+
|`assets`|`array`|UUIDs of the assets involved in the alert.|
1028
+
|`countermeasures`|`array`|Response actions (countermeasures) recommended or applied in reaction to the alert. Each countermeasure has a name, a description, a list of concrete action steps to execute, and a lifecycle status (pending → activated or denied). They can originate from three sources, reflected in the `type` field: `text` (free-form analyst note, e.g. 'Isolate the affected host'), `intelligence_center` (a course of action sourced from SEKOIA.IO's threat intelligence, e.g. 'Block IOC X on your firewall'), or `openc2` (a machine-readable OpenC2 command sent to a security actuator). Included by default; opt out with `?countermeasures=false`.|
1029
+
|`updated_at`|`integer`|Unix timestamp (whole seconds) of the last update to the alert.|
1030
+
|`comments`|`array`|Comments left by analysts on the alert. Each entry carries an `unseen` flag for the current user.|
1031
+
|`ttps`|`array`|MITRE ATT&CK techniques, tactics and procedures (TTPs) associated with the alert, as minimal STIX objects.|
1032
+
|`number_of_unseen_comments`|`integer`|Number of comments on the alert not yet seen by the current user.|
1033
+
|`status`|`object`|Current workflow status of the alert (e.g. `Pending`, `Acknowledged`, `Ongoing`, `Closed`).|
1034
1034
|`custom_status_uuid`|`string`| UUID of the custom status associated to the alert |
1035
1035
|`custom_status`|`object`||
1036
1036
|`verdict`|`object`||
1037
-
|`created_by`|`string`||
1038
-
|`updated_by`|`string`||
1039
-
|`source`|`string`||
1040
-
|`community_uuid`|`string`||
1041
-
|`number_of_total_comments`|`integer`||
1042
-
|`uuid`|`string`||
1043
-
|`rule`|`object`||
1044
-
|`adversaries`|`array`||
1045
-
|`short_id`|`string`||
1046
-
|`first_seen_at`|`string`||
1047
-
|`last_seen_at`|`string`||
1037
+
|`created_by`|`string`|UUID of the profile that created the alert.|
1038
+
|`updated_by`|`string`|UUID of the profile that last updated the alert.|
1039
+
|`source`|`string`|Source of the suspicious activity (e.g. an IP address or hostname).|
1040
+
|`community_uuid`|`string`|UUID of the community the alert belongs to.|
1041
+
|`number_of_total_comments`|`integer`|Total number of comments on the alert.|
1042
+
|`uuid`|`string`|Unique identifier of the alert.|
1043
+
|`rule`|`object`|Detection rule that triggered the alert.|
1044
+
|`adversaries`|`array`|Threat actors or adversary groups attributed to the alert, as minimal STIX Domain Objects (for example, `threat-actor`).|
1045
+
|`short_id`|`string`|Human-readable short identifier for the alert (e.g. `ALa1b2c3d4e5`).|
1046
+
|`first_seen_at`|`string`|Timestamp of the first event that contributed to this alert.|
1047
+
|`last_seen_at`|`string`|Timestamp of the most recent event that contributed to this alert.|
1048
1048
|`event_uuids`|`array`||
1049
-
|`kill_chain_short_id`|`string`||
1050
-
|`similar`|`integer`||
1051
-
|`alert_type`|`object`||
1052
-
|`details`|`string`||
1053
-
|`stix`|`object`||
1054
-
|`created_by_type`|`string`||
1055
-
|`entity`|`object`||
1056
-
|`created_at`|`integer`||
1057
-
|`updated_by_type`|`string`||
1058
-
|`title`|`string`||
1059
-
|`target`|`string`||
1060
-
|`cases`|`array`||
1049
+
|`kill_chain_short_id`|`string`|Short identifier of the MITRE ATT&CK tactic associated with the alert (e.g. `TA0001` for Initial Access).|
1050
+
|`similar`|`integer`|Number of similar alerts detected by the platform's deduplication mechanism.|
1051
+
|`alert_type`|`object`|Category and value describing the type of threat (e.g. category `malware`, value `ransomware`).|
1052
+
|`details`|`string`|Free-text field providing additional analyst context or notes about the alert.|
1053
+
|`stix`|`object`|Full STIX 2 bundle describing the alert and its related objects. Only populated when `?stix=true` is passed.|
1054
+
|`created_by_type`|`string`|Type of the profile that created the alert (e.g. `application`, `avatar`).|
1055
+
|`entity`|`object`|Entity (asset group) targeted by the alert.|
1056
+
|`created_at`|`integer`|Unix timestamp in whole seconds when the alert was created.|
1057
+
|`updated_by_type`|`string`|Type of the profile that last updated the alert (e.g. `application`, `avatar`).|
1058
+
|`title`|`string`|Human-readable title of the alert.|
1059
+
|`target`|`string`|Target of the suspicious activity (e.g. an IP address or hostname).|
1060
+
|`cases`|`array`|Cases this alert has been grouped into. Only populated when `?cases=true` is passed.|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments