Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Threat Actor → Create
AI-generatedSummary
Create a new Threat Actor in OpenCTI.
Inputs
- name (required) — Name of the threat actor (minimum 2 characters)
- aliases — Comma-separated list of aliases
- confidence — Confidence score (0-100)
- createdBy — Identity ID of the creator
- description — Free‑form description
- first_seen — First seen timestamp (ISO 8601)
- goals — Comma-separated list of goals
- objectLabel — Comma-separated IDs of labels
- last_seen — Last seen timestamp (ISO 8601)
- objectMarking — Comma-separated IDs of marking definitions
- primary_motivation — Primary motivation (categorical)
- resource_level — Resource level (categorical)
- roles — Comma-separated roles
- sophistication — Sophistication level (categorical)
- threat_actor_types — Comma-separated threat actor types
Output shape
a single Threat Actor object
Returns the created entity with generated ID and all provided fields; optional pagination not applicable.
Examples
Example 1: Adding a new nation‑state actor with basic metadata
Name: "APT29", primary_motivation: "ideology", resource_level: "organization", threat_actor_types: "nation-state", confidence: 90