Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Sighting → Update
AI-generatedSummary
Update a Sighting record with specified fields.
Inputs
- sightingId (required) — Identifier of the Sighting to update
- attribute_count — Number of attributes to update (default 1)
- confidence — Confidence level (0-100) of the sighting
- description — Description text of the sighting
- first_seen — First seen timestamp (ISO‑8601)
- last_seen — Last seen timestamp (ISO‑8601)
- x_opencti_negative — Flag indicating a negative/false‑positive sighting
Output shape
a single Sighting object
Returns the updated Sighting record; errors follow standard n8n error format.
Examples
Example 1: Update a sighting with a new description and confidence
sightingId: "123", updateFields: {description: "New observation", confidence: 75}