OpenCTIInstall

Summary

Update a threat actor with the provided fields.

Inputs

• threatActorId (required) — Unique identifier of the threat actor to update.
• updateFields — Fields to update, including name, aliases, description, dates, motivations, etc.

Output shape

updated Threat Actor record

Returns the updated record with all fields after the update operation; fields not included are left unchanged.

Examples

Example 1: Change the name and aliases of an existing threat actor

{"threatActorId":"12345","updateFields":{"name":"APT42","aliases":"APT42, Red Dragon"}}

Example 2: Set motivation and sophistication for a threat actor

{"threatActorId":"98765","updateFields":{"primary_motivation":"Financial","sophistication":"high"}}

Example 3: Configure timing information for a threat actor

{"threatActorId":"55555","updateFields":{"first_seen":"2023-01-01T00:00:00Z","last_seen":"2024-12-31T23:59:59Z"}}

Links

• n8n community nodes installation guide