Search and read indicators, reports, observables and other threat intelligence in your OpenCTI platform, and create indicators and reports.
Explore 10 workflow actions for OpenCTI, including account permissions and operation limits.
7 read actions3 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Create indicator
Write
Creates an indicator from a detection pattern (STIX, Sigma, YARA and others), optionally with its observables.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create report
Write
Creates a report, optionally containing existing objects.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete indicator
Write
Deletes an indicator.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
A repeated request may repeat the external action. Review the previous result before retrying a write.
Get indicator
Read
One indicator.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Get observable
Read
One cyber observable.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Get report
Read
One report.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Search indicators
Read
Indicators matching search text or filters, a page at a time.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Search knowledge
Read
Any knowledge objects (threat actors, malware, vulnerabilities, reports and more) matching search text, types or filters.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Search observables
Read
Cyber observables (IPs, domains, hashes, URLs and more) matching search text, types or filters.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
Search reports
Read
Reports matching search text or filters, a page at a time.
Permissions and limits
Account permissions
An OpenCTI API key (profile > API access) for a user with Knowledge access; creating needs KNUPDATE and deleting KNDELETE
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in OpenCTI. A saved workflow is not a completed provider action.
Security & Identity · CONNECTION
