Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Sighting → Search
AI-generatedSummary
Search for sighting records using optional filters such as entity IDs, types, and a term.
Inputs
- fromOrToId — Filter by entity appearing on either side of the sighting
- fromId — From Entity ID
- fromTypes — Comma-separated source entity types
- search — Search term
- toId — To Entity ID
- toTypes — Comma-separated target entity types
- limit — Max number of results to return
Output shape
an array of sighting objects
Each object contains sighting details; may include pagination metadata in extended responses.
Examples
Example 1: Find sightings involving a specific entity
fromId: 'Entity-123', limit: 10
Example 2: Search by term and type categories
search: 'ransomware', fromTypes: 'malware', toTypes: 'attack-pattern'