Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Course of Action → Create
AI-generatedSummary
Create a new Course of Action in openCti.
Inputs
- name (required) — Name of the Course of Action.
- confidence — Confidence level (0-100).
- createdBy — Created By (Identity ID).
- description — Description of the Course of Action.
- externalReferences — External References (IDs).
- objectLabel — Labels (IDs).
- objectMarking — Marking Definitions (IDs).
- x_mitre_id — MITRE ATT&CK ID.
Output shape
a single Course of Action record
Returns the created object; includes generated IDs and all provided fields; success response only.
Examples
Example 1: Add a new Course of Action with name and MITRE ID
name: "Phishing Campaign", x_mitre_id: "M1566", confidence: 75