Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Indicator → Update
AI-generatedSummary
Update an existing openCTI indicator with specified field values.
Inputs
- indicatorId (required) — The unique identifier of the indicator to update.
- updateFields — A collection of fields to update for the indicator, each specifying a property such as name, description, confidence, etc.
Output shape
the updated indicator object
Returns the full indicator record after the update; fields not provided remain unchanged.
Examples
Example 1: Update the confidence and description of an indicator
Set indicatorId to "indicator-123" and updateFields to {"confidence":75,"description":"New description"}
Example 2: Modify validity period of an indicator
Provide indicatorId="indicator-456" with updateFields {"valid_from":"2024-01-01T00:00:00Z","valid_until":"2025-01-01T00:00:00Z"}