OpenCTIInstall

Summary

Create a new incident in OpenCTI

Inputs

• name (required) — Name of the incident (minimum 2 characters)
• additionalFields — Additional fields to attach to the incident, provided as key-value pairs.
• aliases — Comma-separated list of aliases for the incident.
• confidence — Confidence level (0-100) of the incident data.
• createdBy — Identity ID of the creator of the incident.
• description — Free‑form description of the incident.
• first_seen — Timestamp when the incident was first observed.
• incident_type — Type of incident (e.g., intrusion, malware).
• objectLabel — Comma-separated IDs of labels associated with the incident.
• last_seen — Timestamp when the incident was last observed.
• objectMarking — Comma-separated IDs of marking definitions applied to the incident.
• objective — Objective or goal associated with the incident.
• severity — Severity level of the incident (critical, high, low, medium).
• source — Source identifier for the incident.

Output shape

a single incident object

Contains the created incident's ID and all returned attributes; may include system‑generated fields such as timestamps or version numbers.

Examples

Example 1: Creating an incident with basic attributes

Set Name='Phishing Campaign', Description='Spear‑phishing of Finance', Severity='high', and optionally add Aliases and Confidence.

Example 2: Creating an incident with full metadata

Provide Name, Description, Aliases, Confidence, Created By, First Seen, Incident Type, Labels, Last Seen, Object Marking, Objective, Severity, and Source; leave optional fields empty as needed.

Links

• n8n community nodes installation guide