Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Sighting → Create
AI-generatedSummary
Create a new Sighting linking an entity to a target with optional attributes and fields.
Inputs
- fromId (required) — Source entity ID (typically the indicator/observable that was sighted).
- toId (required) — Target entity ID (where it was sighted, typically an organization/system).
- attribute_count (required) — Number of times the entity was sighted.
- additionalFields — Optional collection of extra attributes such as confidence, description, external references, labels, dates, marking definitions, and negative sighting flag.
Output shape
Created Sighting entity with generated ID and populated fields.
Returned object includes the new record's ID and all fields; missing optional fields are omitted.
Examples
Example 1: Add a sighting of indicator ID 12345 sighted on organization ID 98765, counted twice, with confidence 80 and description.
fromId: 12345, toId: 98765, attribute_count: 2, additionalFields: {"confidence": 80, "description": "Phishing campaign observed"}