Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Individual → Get
AI-generatedSummary
Retrieve an Individual by its ID from the OpenCTI graph.
Inputs
- individualId (required) — Identifier of the Individual to fetch.
Output shape
A single Individual object
Returns the full Individual resource; if the ID does not exist the response may be empty or an error.
Examples
Example 1: Fetch details of a known threat actor
individualId: "indicator--12345"
Example 2: Lookup an Individual in a workflow that processes alerts
individualId: "victim--abcdef"
Example 3: Trigger downstream analysis after retrieving an Individual
individualId: "campaign--78901"