Actions149
- Attack Pattern Actions
- Campaign Actions
- City Actions
- Country Actions
- Course of Action Actions
- External Reference Actions
- Incident Actions
- Indicator Actions
- Individual Actions
- Infrastructure Actions
- Intrusion Set Actions
- Kill Chain Phase Actions
- Label Actions
- Malware Actions
- Marking Definition Actions
- Note (RFI) Actions
- Observable Actions
- Observed Data Actions
- Opinion Actions
- Position Actions
- Region Actions
- Relationship Actions
- Report Actions
- Sector Actions
- Sighting Actions
- System Actions
- Task Actions
- Threat Actor Actions
- Tool Actions
- Vulnerability Actions
Tool → Create
AI-generatedSummary
Create a new OpenCTI tool
Inputs
- name (required) — Human‑readable name of the tool.
- aliases — Comma‑separated aliases for the tool.
- confidence — Confidence score (0‑100) for the tool.
- createdBy — Identity ID of the creator.
- description — Free‑form description of the tool.
- externalReferences — Comma‑separated external reference IDs.
- killChainPhases — Comma‑separated kill chain phase IDs.
- objectLabel — Comma‑separated label IDs.
- objectMarking — Comma‑separated marking definition IDs.
- tool_types — Comma‑separated tool type identifiers.
- tool_version — Version string of the tool.
Output shape
a single record representing the created tool
Returns the full created tool object including its generated ID and all supplied fields; HTTP 201 on success, error details on failure.
Examples
Example 1: Add a new network scanner tool
Name: "OpenVAS"; Additional Fields: {"aliases":"scanner1, scanner2","confidence":80,"description":"Vulnerability scanner","tool_types":"vulnerability_scanner","tool_version":"12.0"}
Example 2: Create a threat intel tool with labels
Name: "ThreatIntelFeed"; Additional Fields: {"labels":"lab-001,lab-002","externalReferences":"ref-123","tool_version":"1.5"}
Example 3: Create a simple tool with minimal fields
Name: "CustomTool"; Additional Fields: {"tool_version":"0.1"}