Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Kill Chain Phase → Update
AI-generatedSummary
Update a kill chain phase
Inputs
- killChainPhaseId (required) — Identifier of the kill chain phase to update.
- updateFields — Fields to update on the kill chain phase; collection of key-value pairs.
Output shape
a single updated kill chain phase object
The operation returns the updated phase record; may include warnings if required fields are missing.
Examples
Example 1: Update order and name of a kill chain phase
Set killChainPhaseId to "phase-123", updateFields.kill_chain_name to "Reconnaissance", updateFields.x_opencti_order to 1
Example 2: Modify multiple fields at once
Provide killChainPhaseId and updateFields with kill_chain_name, phase_name, and x_opencti_order values