OpenCTI icon

OpenCTI

Interact with the OpenCTI Cyber Threat Intelligence platform

Actions149

Infrastructure → Create

AI-generated

Summary

Create an infrastructure object with provided metadata and optional attributes.

Inputs

  • name (required) — Human‑readable name of the infrastructure.
  • additionalFields — Optional collection of extra attributes for the infrastructure.
  • aliases — Comma‑separated list of aliases for the infrastructure.
  • confidence — Confidence score (0‑100) associated with the infrastructure.
  • createdBy — Identity ID of the creator.
  • description — Free‑form description of the infrastructure.
  • externalReferences — Comma‑separated IDs of external references linked to the infrastructure.
  • first_seen — Timestamp when the infrastructure was first observed.
  • infrastructure_types — Comma‑separated list of infrastructure type identifiers.
  • killChainPhases — Comma‑separated IDs of kill‑chain phases associated with the infrastructure.
  • objectLabel — Comma‑separated IDs of labels applied to the infrastructure.
  • last_seen — Timestamp of the most recent observation of the infrastructure.
  • objectMarking — Comma‑separated IDs of marking definitions applied to the infrastructure.

Output shape

A single infrastructure object representing the newly created resource.

The response includes all provided fields plus system‑generated identifiers; optional fields may be omitted if empty.

Examples

Example 1: Create a new infrastructure entry with a name and basic metadata.

{"name":"Example Corp","description":"Corporate network segment","aliases":"corp-net"}

Links

Discussion