OpenCTIInstall

Summary

Create a new malware entry in OpenCTI

Inputs

• name (required) — Name of the malware (minimum 2 characters)
• aliases — Comma-separated list of aliases
• confidence — Confidence rating (0-100)
• createdBy — Identity ID of the creator
• description — Free-text description of the malware
• first_seen — Timestamp of first observation
• is_family — Whether this represents a malware family or a specific instance
• objectLabel — Comma-separated IDs of labels
• last_seen — Timestamp of last observation
• malware_types — Comma-separated types (e.g. ransomware, trojan, worm, backdoor)
• objectMarking — Comma-separated IDs of marking definitions

Output shape

a single created malware record

Returns the full malware object as stored, including generated IDs; optional fields may be omitted if not provided

Examples

Example 1: Add a malware named 'Alpha' with confidence 80 and description 'Advanced ransomware'

{"name":"Alpha","additionalFields":{"confidence":80,"description":"Advanced ransomware"}}

Example 2: Create a malware family 'Beta' with aliases 'Beta1,Beta2' and marking definition ID '123'

{"name":"Beta","additionalFields":{"aliases":"Beta1,Beta2","is_family":true,"objectMarking":"123"}}

Links

• n8n community nodes installation guide