Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Marking Definition → Update
AI-generatedSummary
Update a Marking Definition in OpenCTI
Inputs
- markingDefinitionId (required) — The ID of the Marking Definition to update.
- updateFields — Collection of fields to update on the Marking Definition; supports color, definition, and order.
Output shape
a single Marking Definition object
Returns the updated Marking Definition; may include changed fields; errors are handled by n8n.
Examples
Example 1: Update the color and order of an existing Marking Definition
Set markingDefinitionId to "example-marker-123", updateFields to {"x_opencti_color":"red","x_opencti_order":5}
Example 2: Modify definition text without changing other attributes
Set markingDefinitionId to "example-marker-123", updateFields to {"definition":"New definition text"}