Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Marking Definition → Create
AI-generatedSummary
Create a new Marking Definition in OpenCTI
Inputs
- definition_type (required) — The type of the marking definition (e.g., TLP, PAP)
- definition (required) — The definition value of the marking definition (e.g., "TLP:WHITE")
- x_opencti_order (required) — The order position of the marking definition (integer)
- additionalFields — Optional extra fields for the marking definition (e.g., color)
Output shape
A newly created Marking Definition object.
Returns the created record, including generated IDs; optional additionalFields may be merged.
Examples
Example 1: Create a marking definition for TLP:WHITE with order 10 and default color.
definition_type: "TLP", definition: "WHITE", x_opencti_order: 10, additionalFields: {x_opencti_color: "#FF0000"}