OpenCTIInstall

Summary

Create an attack pattern in OpenCTI, providing a name and optional attributes such as MITRE ID, confidence, and external references.

Inputs

• name (required) — Human‑readable name of the attack pattern.
• aliases — Comma‑separated list of alternative names.
• confidence — Confidence score (0‑100) for the pattern.
• createdBy — Identity ID of the creator.
• description — Free‑form description of the pattern.
• externalReferences — Comma‑separated IDs of external references.
• killChainPhases — Comma‑separated IDs of kill chain phases.
• objectLabel — Comma‑separated IDs of labels.
• objectMarking — Comma‑separated IDs of marking definitions.
• x_mitre_id — MITRE ATT&CK ID (e.g., T1059).
• x_mitre_detection — MITRE detection information.
• x_mitre_platforms — Comma‑separated platforms (e.g., Windows, Linux).

Output shape

a single created Attack Pattern object

The response returns the full created object with generated IDs; optional fields may be omitted; on error an error envelope is returned.

Examples

Example 1: Create a basic attack pattern with only a name.

Set Name to "Spear‑phishing" and leave all other fields empty.

Example 2: Create an attack pattern with a MITRE ID and confidence.

Set Name to "Ransomware", x_mitre_id to "T1486", and confidence to 80.

Example 3: Create a pattern with multiple additional fields.

Provide Name "Supply‑Chain Attack", aliases "SCA1, SCA2", confidence 90, createdBy "123", description "Targeting vendor X", externalReferences "REF1,REF2", killChainPhases "Phase1", objectLabel "LABEL1", objectMarking "MARK1", x_mitre_id "T1078", x_mitre_platforms "Windows,Linux".

Links

• n8n community nodes installation guide