Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Observed Data → Create
AI-generatedSummary
Create a new observed data record
Inputs
- first_observed (required) — The beginning of the time window during which the data was observed
- last_observed (required) — The end of the time window during which the data was observed
- number_observed (required) — The number of times the data was observed
- additionalFields — Optional additional fields such as confidence, createdBy, external references, labels, marking definitions, and contained objects
Output shape
a single Observed Data object (including generated ID and timestamps)
The response contains the full created record; optional fields may be omitted if not provided.
Examples
Example 1: Create observed data for a phishing campaign
{"first_observed":"2023-01-01T00:00:00Z","last_observed":"2023-01-31T23:59:59Z","number_observed":12,"additionalFields":{"confidence":75,"objects":"campaign-123"}}