Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Marking Definition → Get
AI-generatedSummary
Fetch a specific Marking Definition by its identifier.
Inputs
- markingDefinitionId (required) — Identifier of the Marking Definition to retrieve.
Output shape
a single Marking Definition object
Returns the full Marking Definition record with its fields (e.g., id, createdAt, updatedAt, name, description, color, etc.) as defined by the OpenCTI schema.
Examples
Example 1: Retrieve a marking definition by its ID
operation: Get, markingDefinitionId: "5e0b1c2d3f..."
Example 2: Get a marking definition associated with a campaign
operation: Get, markingDefinitionId: "marking-def-001"