Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Observable → Create
AI-generatedSummary
Create a new observable of a specified type with a value and optional additional fields.
Inputs
- observableType (required) — The type of observable to create (e.g., IPv4-Addr, Domain-Name, URL).
- observableValue (required) — The main value of the observable (e.g., an IP address, domain, URL, email).
- additionalFields — Optional collection of extra fields such as createIndicator, createdBy, description, externalReferences, objectLabel, objectMarking, and score.
Output shape
a single created observable record
The response includes the created observable's ID and attributes; may include additional fields based on configuration.
Examples
Example 1: Add a new IPv4 address observable for a known malicious server.
observableType: IPv4-Addr, observableValue: 203.0.113.45, additionalFields: {description: "Test entry", score: 75}
Example 2: Create a URL observable and automatically generate an indicator.
observableType: Url, observableValue: http://evil.example.com, additionalFields: {createIndicator: true, description: "Phishing URL"}
Example 3: Create a cryptographic key observable with external references.
observableType: Cryptographic-Key, observableValue: abc123def456, additionalFields: {externalReferences: "ref1,ref2", objectLabel: "malicious-key"}