Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Intrusion Set → Create
AI-generatedSummary
Create a new intrusion set by sending required and optional fields to the OpenCTI API.
Inputs
- name (required) — Name of the intrusion set
- additionalFields — Container for additional fields (e.g., aliases, confidence, createdBy, description, externalReferences, first_seen, goals, objectLabel, last_seen, objectMarking, primary_motivation, resource_level, secondary_motivations)
- aliases — Comma-separated aliases
- confidence — Confidence level (0-100)
- createdBy — Identity ID of the creator
- description — Free‑form description
- externalReferences — Comma‑separated IDs of external references
- first_seen — First seen timestamp
- goals — Comma-separated goals
- objectLabel — Comma‑separated IDs of labels
- last_seen — Last seen timestamp
- objectMarking — Comma‑separated IDs of marking definitions
- primary_motivation — Primary motivation
- resource_level — Resource level
- secondary_motivations — Comma‑separated secondary motivations
Output shape
a single intrusion set record
Returns the created object, including generated identifiers and echoed fields; may include additional system fields.
Examples
Example 1: Create an intrusion set named 'APT29' with basic metadata
name=APT29; description='Advanced Persistent Threat 29'; confidence=80; createdBy=admin