Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Note (RFI) → Create
AI-generatedSummary
Create a new openCTI Note (RFI) with optional metadata fields.
Inputs
- content (required) — Content of the note/RFI (minimum 2 characters)
- additionalFields — Collection of optional metadata fields for the note
- attribute_abstract — Brief abstract/summary of the note
- authors — Comma-separated author names
- confidence — Likelihood score (0-100)
- createdBy — Comma-separated IDs of related identity
- objectLabel — Comma-separated IDs of labels
- likelihood — Likelihood score (0-100)
- objectMarking — Comma-separated IDs of marking definitions
- note_types — Comma-separated note types (e.g. assessment, internal)
- objects — Comma-separated IDs of related STIX objects
Output shape
A JSON object representing the created Note, including its generated ID and timestamps
On success the full created Note is returned; on failure a standard error envelope is returned
Examples
Example 1: Add a new RFI note about a phishing campaign
Set content to "Phishing campaign targeting finance sector", confidence to 75, note_types to "assessment", and include one additional field for related STIX object IDs.