OpenCTIInstall

Summary

Create a new openCti indicator.

Inputs

• name (required) — Indicator name (minimum 2 characters)
• pattern (required) — Detection pattern in the selected language
• pattern_type (required) — Pattern language (e.g., STIX, YARA)
• additionalFields — Optional collection of extra fields to add
• createdBy — Identity ID of the creator
• description — Free‑form description of the indicator
• x_opencti_detection — Whether the indicator is used for detection
• indicator_types — Comma‑separated indicator types
• objectLabel — Comma‑separated label IDs
• x_opencti_main_observable_type — Main observable type (e.g., IPv4-Addr)
• objectMarking — Comma‑separated marking definition IDs
• x_opencti_score — Numerical score (0‑100)
• valid_from — Valid‑from timestamp
• valid_until — Valid‑until timestamp

Output shape

a single indicator object

The response contains the full created indicator, including all provided fields.

Examples

Example 1: Create an indicator for a malicious IP address

Name: "Malicious-IP"; Pattern: "ipv4-addr:value = ''1.2.3.4''"; Pattern Type: "stix"; Additional Fields: {"confidence": 80, "indicator_types": "malicious-activity"}

Links

• n8n community nodes installation guide