Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Report → Create
AI-generatedSummary
Create a new openCTI report with specified metadata and additional fields.
Inputs
- name (required) — Name of the report (minimum 2 characters)
- published (required) — Publication date of the report
- additionalFields — Additional fields for the report (collection of key-value pairs)
- createdBy — Identity ID of the creator
- description — Description of the report
- externalReferences — Comma-separated IDs of external references
- objectLabel — Comma-separated IDs of labels
- objectMarking — Comma-separated IDs of marking definitions
- objects — Comma-separated IDs of STIX objects contained in this report
- x_opencti_reliability — Reliability rating of the report
- report_types — Comma-separated report types (e.g. threat-report, internal-report)
Output shape
a single report object
The created report is returned with its generated ID; optional fields may be omitted; errors are indicated by a status code without a body.
Examples
Example 1: Create a report for a threat analysis
Provide name='APT28 Activity', published='2024-09-20T10:00:00Z', additionalFields={content='Detailed analysis of APT28 activities', confidence=80, reliability='A - Completely Reliable', report_types='threat-report'}