Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Kill Chain Phase → Create
AI-generatedSummary
Create a kill chain phase. Provide the phase name, kill chain name, and order to persist it in OpenCTI.
Inputs
- kill_chain_name (required) — The name of the kill chain (e.g. lockheed-martin-cyber-kill-chain)
- phase_name (required) — The name of the phase in the kill chain
- x_opencti_order (required) — The order of the phase in the kill chain
Output shape
a single Kill Chain Phase object
Includes the created object's ID and returned attributes; operation succeeds with a 201 response or fails with an error.
Examples
Example 1: Add a new phase to an existing kill chain
kill_chain_name: 'lockheed-martin-cyber-kill-chain', phase_name: 'Reconnaissance', x_opencti_order: 1