Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
External Reference → Create
AI-generatedSummary
Create a new external reference
Inputs
- source_name (required) — The name of the external reference source
- description — Description of the external reference
- external_id — External identifier for the external reference
- hash — Hash of the external reference
- url — URL of the external reference
Output shape
a single External Reference object
The response includes the created object's fields, including an assigned ID; optional fields may be omitted.
Examples
Example 1: Create an external reference with full details
source_name: 'Threat Intel'; additionalFields: {description: 'Malware sample', external_id: 'MAL-001', hash: 'sha256:abc123', url: 'https://example.com/malware'}
Example 2: Create an external reference with just a name
source_name: 'Phishing Campaign'; additionalFields: {}