| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\napi\\_version\n\n | \n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n |
| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\nobservables\n\n | \n\nRequired. List of observable objects to add to TISC. For each observable object, an observable source record is created if all validations are passed, with the source as defined by the **source** parameter in the request body.Data type: Array of Objects\n\n```\n\"observables\": [\n {\n \"attributes\": {Object},\n \" |
| \n\nobservables.attributes\n\n | \n\nField-value pairs containing attribute data about the observable. Attributes are specific to an observable type, such as the AS number for an IP address or the socket type for a network. All attributes for all observable types are supported. For a complete list of valid attributes, see the Observable attributes section below.\n\nData type: Object\n\n```\n\"attributes\": {\n \" |
| \n\nobservables.<field>\n\n | \n\nName-value pairs containing general data about the observable. The fields that can be provided in this parameter are common to all observable types.The **type** and **value** fields are required for all observables.\n\n**Note:** Follow these guidelines for providing values:\n\n- All dates must be in ISO format in the UTC timezone.\n- Some fields require values from a specified table or have a list of possible values. If invalid values are provided for these fields, the observable source record is still created but the invalid values are skipped.\n\nValid fields:\n\n- **additional\\_context**\n\nAdditional context about the observable.\n\n- **attack\\_phases**\n\nList of attack phase names as a comma separated value. For a complete list of valid attack phases, see the **Kill Chain Phase Name** field in the Kill Chain Phase \\[sn\\_sec\\_tisc\\_kill\\_chain\\_phase\\] table.\n\nFor example:\n\n ```\n\"attack_phases\": \"Lockheed Martin: Reconnaissance,Lockheed Martin: Installation\"\n ```\n\n- **author**\n\nAuthor for the observable.\n\n- **confidence**\n\nThe confidence that the source system has in the correctness of the observable data. Must be a number from 0–100.\n\n- **description**\n\nDescription of the observable.\n\n- **expiration\\_time**\n\nExpiration date of the observable record.\n\n- **external\\_source\\_id**\n\nExternal ID of the observable from the source system.\n\n- **first\\_observed**\n\nDate the data was first seen.\n\n- **first\\_seen**\n\nDate this observable was first seen performing malicious activities.\n\n- **last\\_observed**\n\nDate the data was last seen.\n\n- **last\\_seen**\n\nDate this observable was last seen performing malicious activities.\n\n- **notes**\n\nAny additional notes for the observable. Can be formatted as HTML.\n\n- **reputation**\n\nReputation of the observable.\n\nPossible values:\n\n - clear\n - malicious\n - suspicious\n - unknown\n- **source\\_reported\\_score**\n\nMaliciousness score of the observable reported by the source system. Must be a number from 0–100.\n\n- **tags**\n\nList of tags as a comma-separated value. For a complete list of valid tags, see the **Name** field in the Tag \\[sn\\_sec\\_tisc\\_tag\\] table. If the provided tag doesn’t exist, the tag is automatically created and associated with the observable.\n\n- **taxonomies**\n\nList of taxonomies as a comma-separated value. For a complete list of valid taxonomies, see the **Taxonomy Value** field in the Taxonomy Value \\[sn\\_sec\\_tisc\\_taxonomy\\_value\\] table.\n\n- **threat\\_level**\n\nThreat level of the observable.\n\nPossible values:\n\n - low\n - medium\n - high\n- **threat\\_severity**\n\nThreat severity of the observable.\n\nPossible values:\n\n - low\n - medium\n - high\n - critical\n- **tlp**\n\nData sensitivity level for the observable using the traffic light protocol \\(TLP\\).\n\nPossible values:\n\n - CLEAR\n - GREEN\n - AMBER\n - AMBER+STRICT\n - RED\nTable: In the Label field in the TLP Label \\[sn\\_sec\\_tisc\\_tlp\\_label\\] table.\n\n- **type**\n\nRequired. Type of observable.\n\nFor a complete list of valid observable types, see the **Value** field in the Observable Type \\[sn\\_sec\\_tisc\\_observable\\_type\\] table, or the Observable attributes section below.\n\n- **usage\\_categories**\n\nList of usage categories as a comma-separated value. For a complete list of valid usage categories, see the **Usage Category** field in the Usage Category \\[sn\\_sec\\_tisc\\_usage\\_category\\] table.\n\n- **value**\n\nRequired. Value associated with the observable, such as an IP address or URL.\n\n\nData type: String\n\nTable: Observable Source \\[sn\\_sec\\_tisc\\_observable\\_source\\]\n\n |
| \n\nsource\n\n | \n\nRequired. Source that originally detected the observables, such as a SIEM system.The source is used for all observables listed in the API request.\n\nData type: String\n\nStored in: Sources provided in the request body are added to the API Integration \\[sn\\_sec\\_tisc\\_api\\_integration\\] table.\n\n |
| \n\nStatus code\n\n | \n\nDescription\n\n |
|---|---|
| \n\n200\n\n | \n\nSuccessful. The request was successfully processed.\n\n |
| \n\n400\n\n | \n\nBad request. The request parameters are invalid or the request body JSON has a syntactical error.To view details about the error, see the **error** parameter in the response body.\n\n |
| \n\n401\n\n | \n\nUnauthorized. The user authentication is invalid. Check the user name and password or OAuth token.\n\n |
| \n\n403\n\n | \n\nForbidden. The calling user is missing a required role. The sn\\_sec\\_tisc.api\\_obs\\_write\\_access role is required to access this endpoint.\n\n |
| \n\n429\n\n | \n\nToo many requests. The number of API requests exceeds the rate limit for the API. By default, the limit is 100 requests per hour.\n\n |
| \n\n500\n\n | \n\nInternal server error. Check application logs in the Log \\[syslog\\] table for more information about the error.\n\n |
| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\nerror\n\n | \n\nError information. This parameter is only returned if the request failed.Data type: Object\n\n```\n\"error\": {\n \"message\": \"String\",\n \"detail\": \"String\"\n}\n```\n\n |
| \n\nerror.message\n\n | \n\nError message containing the reason the request failed.Data type: String\n\n |
| \n\nerror.detail\n\n | \n\nAdditional details about why the request failed.Data type: String\n\n |
| \n\nerror\\_records\n\n | \n\nDetails about the observables included in the request that couldn't be added to TISC.Data type: Array of Objects\n\n```\n\"error_records\": [\n {\n \"error_message\": \"String\",\n \"type\": \"String\",\n \"value\": \"String\"\n }\n]\n```\n\n |
| \n\nerror\\_records.error\\_message\n\n | \n\nError message that explains why a record couldn't be created for the observable.Data type: String\n\n |
| \n\nerror\\_records.type\n\n | \n\nType of observable.For a complete list of valid observable types, see the **Value** field in the Observable Type \\[sn\\_sec\\_tisc\\_observable\\_type\\] table, or the Observable attributes section below.\n\nData type: String\n\n |
| \n\nerror\\_records.value\n\n | \n\nValue associated with the observable, such as an IP address or URL.Data type: String\n\n |
| \n\nmetadata\n\n | \n\nMetadata about the number of records created by the API request. ```\n\"metadata\": {\n \"error_records\": Number,\n \"success_records\": Number,\n \"total_records\": Number\n}\n```\n\nData type: Object\n\n |
| \n\nmetadata.error\\_records\n\n | \n\nNumber of observables included in the request that couldn't be added to TISC.Data type: Number\n\n |
| \n\nmetadata.success\\_records\n\n | \n\nNumber of observable records that were successfully created in TISC.Data type: Number\n\n |
| \n\nmetadata.total\\_records\n\n | \n\nTotal number of observables included in the request.Data type: Number\n\n |
| \n\nstatus\n\n | \n\nStatus of the API request.Possible values:\n\n- `error`: No observables successfully added to TISC.\n- `failure`: The request failed due to a bad request or system error. See the **error** parameter in the response body for more information about the error.\n- `partial_success`: Some observables successfully added to TISC.\n- `success`: All observables successfully added to TISC.\n\nData type: String\n\n |
| \n\nsuccess\\_records\n\n | \n\nDetails about the observable records that were successfully created.Data type: Array of Objects\n\n```\n\"success_records\": [\n {\n \"sys_id\": \"String\",\n \"type\": \"String\",\n \"value\": \"String\"\n }\n]\n```\n\n |
| \n\nsuccess\\_records.sys\\_id\n\n | \n\nSys\\_id of the observable record.Data type: String\n\n |
| \n\nsuccess\\_records.type\n\n | \n\nType of observable. For a complete list of valid observable types, see the **Value** field in the Observable Type \\[sn\\_sec\\_tisc\\_observable\\_type\\] table, or the Observable attributes section below.\n\nData type: String\n\n |
| \n\nsuccess\\_records.value\n\n | \n\nValue associated with the observable, such as an IP address or URL.Data type: String\n\n |
| \n\nObservable type\n\n | \n\nAttributes\n\n | \n\nData type\n\n |
|---|---|---|
| \n\nartifact\n\n | \n\ndecryption\\_key\n\n | \n\nString\n\n |
| \n\nencryption\\_algorithm\n\n | \n\nString\n\n | |
| \n\nmd5\\_hash\n\n | \n\nString\n\n | |
| \n\nmime\\_type\n\n | \n\nString\n\n | |
| \n\nsha1\\_hash\n\n | \n\nString\n\n | |
| \n\nsha256\\_hash\n\n | \n\nString\n\n | |
| \n\nsha512\\_hash\n\n | \n\nString\n\n | |
| \n\nurl\n\n | \n\nString\n\n | |
| \n\nautonomous\\_system\\_number\n\n | \n\nname\n\n | \n\nString\n\n |
| \n\nrir\n\n | \n\nString\n\n | |
| \n\ndirectory\n\n | \n\ndirectory\\_creation\\_time\n\n | \n\nDate\n\n |
| \n\ndirectory\\_last\\_accessed\\_time\n\n | \n\nDate\n\n | |
| \n\ndirectory\\_last\\_modified\\_time\n\n | \n\nDate\n\n | |
| \n\nencoded\\_path\n\n | \n\nString\n\n | |
| \n\ndomain\\_name\n\n | \n\nis\\_fqdn\\(Fully qualified domain name\\)\n\n | \n\nBoolean\n\n |
| \n\nresolves\\_to\n\n | \n\nString\n\n | |
| \n\nemail\\_address\n\n | \n\ndisplay\\_name\n\n | \n\nString\n\n |
| \n\nemail\\_message\n\n | \n\nemail\\_body\n\n | \n\nString\n\n |
| \n\nemail\\_recipients\\_bcc\n\n | \n\nString\n\n | |
| \n\nemail\\_recipients\\_cc\n\n | \n\nString\n\n | |
| \n\nemail\\_recipients\\_to\n\n | \n\nString\n\n | |
| \n\nemail\\_sender\n\n | \n\nString\n\n | |
| \n\nemail\\_subject\n\n | \n\nString\n\n | |
| \n\nsent\\_date\n\n | \n\nDate\n\n | |
| \n\nemail\\_subject\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nfile\n\n | \n\nencoded\\_file\\_name\n\n | \n\nString\n\n |
| \n\nfile\\_created\\_time\n\n | \n\nDate\n\n | |
| \n\nfile\\_last\\_accessed\\_time\n\n | \n\nDate\n\n | |
| \n\nfile\\_last\\_modified\\_time\n\n | \n\nDate\n\n | |
| \n\nfile\\_name\n\n | \n\nString\n\n | |
| \n\nmagic\\_number\n\n | \n\nString\n\n | |
| \n\nmd5\\_hash\n\n | \n\nString\n\n | |
| \n\nmime\\_type\n\n | \n\nString\n\n | |
| \n\nsha1\\_hash\n\n | \n\nString\n\n | |
| \n\nsha256\\_hash\n\n | \n\nString\n\n | |
| \n\nsha512\\_hash\n\n | \n\nString\n\n | |
| \n\nip\\_v4\\_address\n\n | \n\nas\\_number\n\n | \n\nString\n\n |
| \n\nmac\\_address\n\n | \n\nString\n\n | |
| \n\nip\\_v4\\_cidr\n\n | \n\nas\\_number\n\n | \n\nString\n\n |
| \n\nmac\\_address\n\n | \n\nString\n\n | |
| \n\nip\\_v6\\_address\n\n | \n\nas\\_number\n\n | \n\nString\n\n |
| \n\nmac\\_address\n\n | \n\nString\n\n | |
| \n\nip\\_v6\\_cidr\n\n | \n\nas\\_number\n\n | \n\nString\n\n |
| \n\nmac\\_address\n\n | \n\nString\n\n | |
| \n\nmac\\_address\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nmd5\\_hash\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nmutex\\_name\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nnetwork\n\n | \n\ndestination\\_bytes\\_count\n\n | \n\nInteger\n\n |
| \n\ndestination\\_packets\\_count\n\n | \n\nInteger\n\n | |
| \n\ndestination\\_port\n\n | \n\n \n\n | |
| \n\nend\\_time\n\n | \n\nDate\n\n | |
| \n\nhttp\\_message\\_body\\_length\n\n | \n\nInteger\n\n | |
| \n\nhttp\\_request\\_header\n\n | \n\nString\n\n | |
| \n\nhttp\\_request\\_method\n\n | \n\nString\n\n | |
| \n\nhttp\\_request\\_value\n\n | \n\nString\n\n | |
| \n\nhttp\\_request\\_version\n\n | \n\nString\n\n | |
| \n\nnetwork\\_source\n\n | \n\nString\n\n | |
| \n\nnetwork\\_destination\n\n | \n\nString\n\n | |
| \n\nicmp\\_code\\_byte\n\n | \n\nString\n\n | |
| \n\nicmp\\_type\\_byte\n\n | \n\nString\n\n | |
| \n\nis\\_network\\_active\n\n | \n\nBoolean\n\n | |
| \n\nis\\_socket\\_blocking\n\n | \n\nBoolean\n\n | |
| \n\nis\\_socket\\_listening\n\n | \n\nBoolean\n\n | |
| \n\nnetwork\\_protocols\n\n | \n\nString\n\n | |
| \n\nsocket\\_address\\_family\n\n | \n\nStringPossible values:\n\n- af\\_unspec\n- af\\_inet\n- af\\_ipx\n- af\\_appletalk\n- af\\_netbios\n- af\\_inet6\n- af\\_irda\n- af\\_bth\n\n | |
| \n\nsocket\\_descriptor\n\n | \n\nInteger\n\n | |
| \n\nsocket\\_handle\n\n | \n\nInteger\n\n | |
| \n\nsocket\\_options\n\n | \n\nString\n\n | |
| \n\nsocket\\_type\n\n | \n\nStringPossible values:\n\n- service\\_kernel\\_driver\n- service\\_file\\_system\\_driver\n- service\\_win32\\_own\\_process\n- service\\_win32\\_share\\_process\n\n | |
| \n\nsource\\_bytes\\_count\n\n | \n\nInteger\n\n | |
| \n\nsource\\_packets\\_count\n\n | \n\nInteger\n\n | |
| \n\nsource\\_port\n\n | \n\nString\n\n | |
| \n\nstart\\_time\n\n | \n\nDate\n\n | |
| \n\ntcp\\_destination\\_flags\n\n | \n\nString\n\n | |
| \n\ntcp\\_source\\_flags\n\n | \n\nString\n\n | |
| \n\nother\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nprocess\n\n | \n\naslr\\_enabled\n\n | \n\nBoolean\n\n |
| \n\ncommand\\_line\n\n | \n\nString\n\n | |
| \n\ncwd\\(Current Working Directory\\)\n\n | \n\nString\n\n | |
| \n\ndep\\_enabled\n\n | \n\nBoolean\n\n | |
| \n\nenvironment\\_variables\n\n | \n\nString\n\n | |
| \n\nis\\_hidden\n\n | \n\nBoolean\n\n | |
| \n\nowner\\_sid\n\n | \n\nString\n\n | |
| \n\npid\\(Process ID\\)\n\n | \n\nString\n\n | |
| \n\npriority\n\n | \n\nString\n\n | |
| \n\nprocess\\_created\\_time\n\n | \n\nDate\n\n | |
| \n\nservice\\_descriptions\n\n | \n\nString\n\n | |
| \n\nservice\\_display\\_name\n\n | \n\nString\n\n | |
| \n\nservice\\_group\\_name\n\n | \n\nString\n\n | |
| \n\nservice\\_name\n\n | \n\nString\n\n | |
| \n\nservice\\_start\\_type\n\n | \n\nStringPossible values:\n\n- service\\_auto\\_start\n- service\\_boot\\_start\n- service\\_demand\\_start\n- service\\_disabled\n- service\\_system\\_alert\n\n | |
| \n\nservice\\_status\n\n | \n\nStringPossible values:\n\n- service\\_continue\\_pending\n- service\\_pause\\_pending\n- service\\_paused\n- service\\_running\n- service\\_start\\_pending\n- service\\_stop\\_pending\n- service\\_stopped\n\n | |
| \n\nservice\\_type\n\n | \n\nStringPossible values:\n\n- service\\_kernel\\_driver\n- service\\_file\\_system\\_driver\n- service\\_win32\\_own\\_process\n- service\\_win32\\_share\\_process\n\n | |
| \n\nstartup\\_info\n\n | \n\nString\n\n | |
| \n\nwindows\\_integrity\\_level\n\n | \n\nStringPossible values:\n\n- low\n- medium\n- high\n- system\n\n | |
| \n\nwindow\\_title\n\n | \n\nString\n\n | |
| \n\nsha1\\_hash\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nsha256\\_hash\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nsha512\\_hash\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nsoftware\n\n | \n\ncpe\\(Common Platform Enumeration\\)\n\n | \n\nString\n\n |
| \n\nsupported\\_languages\n\n | \n\nString\n\n | |
| \n\nswid\\(Software Identification\\)\n\n | \n\nString\n\n | |
| \n\nvendor\n\n | \n\nString\n\n | |
| \n\nversion\n\n | \n\nString\n\n | |
| \n\nurl\n\n | \n\nNone\n\n | \n\n \n\n |
| \n\nuser\\_account\n\n | \n\naccount\\_created\\_time\n\n | \n\nDate\n\n |
| \n\naccount\\_expiry\\_time\n\n | \n\nDate\n\n | |
| \n\naccount\\_type\n\n | \n\nString\n\n | |
| \n\ncan\\_escalate\\_privileges\n\n | \n\nBoolean\n\n | |
| \n\ncredentials\\_last\\_changed\\_time\n\n | \n\nDate\n\n | |
| \n\ndisplay\\_name\n\n | \n\nString\n\n | |
| \n\nfirst\\_login\\_time\n\n | \n\nDate\n\n | |
| \n\nis\\_account\\_disabled\n\n | \n\nBoolean\n\n | |
| \n\nis\\_privileged\n\n | \n\nBoolean\n\n | |
| \n\nis\\_service\\_account\n\n | \n\nBoolean\n\n | |
| \n\nlast\\_login\\_time\n\n | \n\nDate\n\n | |
| \n\naccount\\_login\n\n | \n\nString\n\n | |
| \n\nuser\\_id\n\n | \n\nString\n\n | |
| \n\nwindows\\_registry\\_key\n\n | \n\nkey\\_modified\\_time\n\n | \n\nDate\n\n |
| \n\nregistry\\_value\n\n | \n\nString\n\n | |
| \n\nsubkeys\\_count\n\n | \n\nInteger\n\n | |
| \n\nx509\\_certificate\n\n | \n\nauthority\\_key\\_identifier\n\n | \n\nString\n\n |
| \n\nbasic\\_constraints\n\n | \n\nString\n\n | |
| \n\ncertificate\\_policies\n\n | \n\nString\n\n | |
| \n\ncrl\\_distribution\\_points\n\n | \n\nString\n\n | |
| \n\nextended\\_key\\_usage\n\n | \n\nString\n\n | |
| \n\ninhibit\\_any\\_policy\n\n | \n\nString\n\n | |
| \n\nissuer\n\n | \n\nString\n\n | |
| \n\nissuer\\_alternative\\_name\n\n | \n\nString\n\n | |
| \n\nis\\_self\\_signed\n\n | \n\nBoolean\n\n | |
| \n\nkey\\_usage\n\n | \n\nString\n\n | |
| \n\nname\\_constraints\n\n | \n\nString\n\n | |
| \n\npolicy\\_constraints\n\n | \n\nString\n\n | |
| \n\npolicy\\_mappings\n\n | \n\nString\n\n | |
| \n\nprivate\\_key\\_usage\\_valid\\_from\n\n | \n\nDate\n\n | |
| \n\nprivate\\_key\\_usage\\_valid\\_until\n\n | \n\nDate\n\n | |
| \n\nsignature\\_algorithm\n\n | \n\nString\n\n | |
| \n\nsubject\n\n | \n\nString\n\n | |
| \n\nsubject\\_alternative\\_name\n\n | \n\nString\n\n | |
| \n\nsubject\\_directory\\_attributes\n\n | \n\nString\n\n | |
| \n\nsubject\\_key\\_identifier\n\n | \n\nString\n\n | |
| \n\nsubject\\_public\\_key\\_algorithm\n\n | \n\nString\n\n | |
| \n\nsubject\\_public\\_key\\_exponent\n\n | \n\nInteger\n\n | |
| \n\nsubject\\_public\\_key\\_modulus\n\n | \n\nString\n\n | |
| \n\nvalid\\_from\n\n | \n\nDate\n\n | |
| \n\nvalid\\_until\n\n | \n\nDate\n\n | |
| \n\nversion\n\n | \n\nString\n\n |
| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\napi\\_version\n\n | \n\nOptional. Version of the endpoint to access. For example, `v1` or `v2`. Only specify this value to use an endpoint version other than the latest. Data type: String\n\n |
| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\nincluded\\_fields\n\n | \n\nFields to return for observables, observable references, and STIX objects in the response. Different fields can be returned for observables, references, and each type of STIX object.ServiceNow system fields, except for sys\\_created\\_on, sys\\_updated\\_on, and sys\\_id, aren't returned in the response.\n\nData type: Object\n\n```\n\"included_fields\": { \n \"observable\": {Object},\n \"reference\": {Object},\n \" |
| \n\nincluded\\_fields.observable\n\n | \n\nFields to return for observables. Data type: Object\n\n```\n\"observable\": { \n \"attributes\": {Object},\n \"common_fields\": {Object}\n}\n```\n\nDefault: Returns the fields syd\\_id, type, and value for all observable types.\n\n |
| \n\nincluded\\_fields.observable.attributes\n\n | \n\nFields to return for specified observable types. Data type: Object\n\n```\n\"attributes\": { \n \" |
| \n\nincluded\\_fields.observable.attributes.<observable\\_type>\n\n | \n\nFields to return for an observable type.Data type: Object\n\n```\n\" |
| \n\nincluded\\_fields.observable.attributes.<observable\\_type>.include\\_all\\_fields\n\n | \n\nFlag that indicates whether to return all available fields for the observable type.Valid values:\n\n- true: Return all fields for the observable type.\n- false: Only return fields specified in the **values** parameter for the observable type.\n\nData type: Boolean\n\n |
| \n\nincluded\\_fields.observable.attributes.<observable\\_type>.values\n\n | \n\nList of fields to return for the observable type. Only use this parameter if the value of **include\\_all\\_fields** is false.Data type: Array of Strings\n\n```\n\"values\": [\n \"String\"\n]\n```\n\nThe fields provided must be column\\_names from the table for the observable type. The following tables are used for observable types.\n\n- Artifact \\[sn\\_sec\\_tisc\\_artifact\\]\n- AS Number \\[sn\\_sec\\_tisc\\_as\\_number\\]\n- Directory \\[sn\\_sec\\_tisc\\_directory\\]\n- Domain Name \\[sn\\_sec\\_tisc\\_domain\\_name\\]\n- Email Address \\[sn\\_sec\\_tisc\\_email\\_address\\]\n- Email Message \\[sn\\_sec\\_tisc\\_email\\_message\\]\n- Email Subject \\[sn\\_sec\\_tisc\\_email\\_subject\\]\n- File \\[sn\\_sec\\_tisc\\_file\\]\n- IPv4 Address \\[sn\\_sec\\_tisc\\_ipv4\\_address\\]\n- IPv4 CIDR \\[sn\\_sec\\_tisc\\_ipv4\\_cidr\\]\n- IPv6 Address \\[sn\\_sec\\_tisc\\_ipv6\\_address\\]\n- IPv6 CIDR \\[sn\\_sec\\_tisc\\_ipv6\\_cidr\\]\n- MAC Address \\[sn\\_sec\\_tisc\\_mac\\_address\\]\n- MD5 Hash \\[sn\\_sec\\_tisc\\_md5\\_hash\\]\n- Mutex Name \\[sn\\_sec\\_tisc\\_mutex\\_name\\]\n- Network \\[sn\\_sec\\_tisc\\_network\\]\n- Other Observable \\[sn\\_sec\\_tisc\\_other\\_observable\\]\n- Process \\[sn\\_sec\\_tisc\\_process\\]\n- SHA1 Hash \\[sn\\_sec\\_tisc\\_sha1\\_hash\\]\n- SHA256 Hash \\[sn\\_sec\\_tisc\\_sha256\\_hash\\]\n- SHA512 Hash \\[sn\\_sec\\_tisc\\_sha512\\_hash\\]\n- Software \\[sn\\_sec\\_tisc\\_software\\]\n- URL \\[sn\\_sec\\_tisc\\_url\\]\n- User Account \\[sn\\_sec\\_tisc\\_user\\_account\\]\n- Windows Registry Key \\[sn\\_sec\\_tisc\\_windows\\_registry\\_key\\]\n- X.509 Certificate \\[sn\\_sec\\_tisc\\_x\\_509\\_certificate\\]\n\n |
| \n\nincluded\\_fields.observable.common\\_fields\n\n | \n\nFields to return for all observable types.The fields must be from the Observable \\[sn\\_sec\\_tisc\\_observable\\] table because they must be common to all observable types.\n\nData type: Object\n\n```\n\"common_fields\": { \n \"include_all_fields\": Boolean, \n \"values\": [Array] \n}\n```\n\nDefault: Returns the fields syd\\_id, type, and value for all observable types.\n\n |
| \n\nincluded\\_fields.observable.common\\_fields.include\\_all\\_fields\n\n | \n\nFlag that indicates whether to return all fields from the Observable \\[sn\\_sec\\_tisc\\_observable\\] table for all observable types.Valid values:\n\n- true: Return all fields from the Observable \\[sn\\_sec\\_tisc\\_observable\\] table.\n- false: Only return fields specified in the **common\\_fields.values** parameter.\n\nData type: Boolean\n\n |
| \n\nincluded\\_fields.observable.common\\_fields.values\n\n | \n\nList of fields to return for all observable types. Only use this parameter if the value of **common\\_fields.include\\_all\\_fields** is false.Data type: Array of Strings\n\n```\n\"values\": [\n \"String\"\n]\n```\n\nThe fields provided must be column names from the Observable \\[sn\\_sec\\_tisc\\_observable\\] table.\n\n |
| \n\nincluded\\_fields.reference\n\n | \n\nFields to return for observable references. Observable references are external references used to describe pointers to information represented outside of STIX.Data type: Object\n\n```\n\"reference\": { \n \"include_all_fields\": Boolean, \n \"values\": [Array] \n}\n```\n\nDefault: Returns the fields reference\\_source, sys\\_id, and url.\n\n |
| \n\nincluded\\_fields.reference.include\\_all\\_fields\n\n | \n\nFlag that indicates whether to return all available fields for observable references.Valid values:\n\n- true: Return all fields for observable references.\n- false: Only return fields specified in the **reference.values** parameter.\n\nData type: Boolean\n\n |
| \n\nincluded\\_fields.reference.values\n\n | \n\nList of fields to return for observable references. Only use this parameter if the value of **reference.include\\_all\\_fields** is false.Data type: Array of Strings\n\n```\n\"values\": [\n \"String\"\n]\n```\n\nThe fields provided must be column names from the Observable Reference \\[sn\\_sec\\_tisc\\_observable\\_reference\\] table.\n\n |
| \n\nincluded\\_fields.<stix\\_object>\n\n | \n\nObject containing fields to return for a STIX object type.Data type: Object\n\n```\n\" |
| \n\nincluded\\_fields.<stix\\_object>.include\\_all\\_fields\n\n | \n\nFlag that indicates whether to return all available fields for the STIX object type.Valid values:\n\n- true: Return all fields for the STIX object type.\n- false: Only return fields specified in the **values** parameter for the STIX object type.\n\nData type: Boolean\n\n |
| \n\nincluded\\_fields.<stix\\_object>.values\n\n | \n\nList of fields to return for the STIX object type. Only use this parameter if the value of **include\\_all\\_fields** is false.Data type: Array of Strings\n\n```\n\"values\": [\n \"String\"\n]\n```\n\nThe fields provided must be column\\_names from the table for the STIX object type. The following tables are used for STIX objects.\n\n- Attack Pattern \\[sn\\_sec\\_tisc\\_attack\\_pattern\\]\n- Campaign \\[sn\\_sec\\_tisc\\_campaign\\]\n- Course of Action \\[sn\\_sec\\_tisc\\_course\\_of\\_action\\]\n- Data Component \\[sn\\_sec\\_tisc\\_aggregated\\_data\\_component\\]\n- Data Source \\[sn\\_sec\\_tisc\\_aggregated\\_data\\_source\\]\n- Grouping \\[sn\\_sec\\_tisc\\_threat\\_grouping\\]\n- Identity \\[sn\\_sec\\_tisc\\_identity\\]\n- Incident \\[sn\\_sec\\_tisc\\_threat\\_event\\]\n- Indicator \\[sn\\_sec\\_tisc\\_indicator\\]\n- Infrastructure \\[sn\\_sec\\_tisc\\_infrastructure\\]\n- Intrusion Set \\[sn\\_sec\\_tisc\\_intrusion\\_set\\]\n- Location \\[sn\\_sec\\_tisc\\_location\\]\n- Malware \\[sn\\_sec\\_tisc\\_malware\\]\n- Malware Analysis \\[sn\\_sec\\_tisc\\_malware\\_analysis\\]\n- Note \\[sn\\_sec\\_tisc\\_threat\\_note\\]\n- Observed Data \\[sn\\_sec\\_tisc\\_observed\\_data\\]\n- Opinion \\[sn\\_sec\\_tisc\\_threat\\_opinion\\]\n- Report \\[sn\\_sec\\_tisc\\_threat\\_report\\]\n- Threat Actor \\[sn\\_sec\\_tisc\\_threat\\_actor\\]\n- Tool \\[sn\\_sec\\_tisc\\_tool\\]\n- Vulnerability \\[sn\\_sec\\_tisc\\_vulnerability\\]\n\n |
| \n\nobservable\\_filters\n\n | \n\nFilters to apply to the observables. Only observables that match the filter criteria are returned in the response.Data type: Object\n\n```\n\"observable_filters\": {\n \"boolean_operator\": \"String\", \n \"filters\": [Array]\n}\n```\n\nDefault: Empty object \\(no filters applied\\)\n\n |
| \n\nobservable\\_filters.boolean\\_operator\n\n | \n\nBoolean operator to use for the filter conditions.Valid values:\n\n- AND: Return observables that meet all filter conditions.\n- OR: Return observables that meet at least one of the filter conditions.\n\nData type: String\n\n |
| \n\nobservable\\_filters.filters\n\n | \n\nFilters to apply to the observables. Each filter object can be simple or complex.\n\n- Simple filters contain a field name, operator, and value.\n- Complex filters contain a Boolean operator and an array of simple filters. The Boolean operator is applied to the array of simple filters.\n\nData type: Array of Objects\n\n```\n\"filters\": [ \n //Simple filter \n { \n \"field_name\": \"String\", \n \"operator\": \"String\", \n \"field_value\": \"String\" \n }, \n //Complex filter \n {\n \"boolean_operator\": \"String\", \n \"filters\": [\n {\n\t \"field_name\": \"String\",\n\t \"operator\": \"String\",\n\t \"field_value\": \"String\"\n } \n ]\n }\n]\n```\n\n |
| \n\nobservable\\_filters.filters.field\\_name\n\n | \n\nName of the field to use to filter the observables. Valid values:\n\n- confidence\n- reputation\n- security\\_type\n- status\n- sys\\_created\\_on\n- sys\\_updated\\_on\n- tags\n- taxonomies\n- threat\\_score\n- type\n- value\n- watch\\_list\n\nData type: String\n\n |
| \n\nobservable\\_filters.filters.operator\n\n | \n\nOperator to use for the filter.For more information about operators, see [Operators available for filters and queries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-user-interface/r_OpAvailableFiltersQueries.md).\n\nThe data type of the filter field determines the valid operators. The following operators are valid for each data type.\n\n- **Boolean**\n\nApplicable field: watch\\_list\n\n - !=\n - =\n - ISEMPTY\n - ISNOTEMPTY\n- **Choice**\n\nApplicable fields: reputation, security\\_type, status\n\n - !=\n - =\n - ENDSWITH\n - IN\n - LIKE\n - NOT IN\n - NOT LIKE\n - STARTSWITH\n- **Date-time**\n\nApplicable fields: sys\\_created\\_on, sys\\_updated\\_on\n\n - <\n - <=\n - >\n - >=\n - ISEMPTY\n - ISNOTEMPTY\n - NOTON\n - ON\n- **GlideList**\n\nApplicable fields: tags, taxonomies\n\n - IN\n - NOT IN\n\n**Note:** Must use a single valid, existing value for the filter condition, and empty observable field values aren't considered a match.\n\n - ISEMPTY\n - ISNOTEMPTY\n - LIKE\n\n**Note:** Must use a single value for the filter condition.\n\n - NOT LIKE\n\n**Note:** Must use a single value for the filter condition, and empty observable field values aren't considered a match.\n\n- **Number**\n\nApplicable fields: confidence, threat\\_score\n\n - !=\n - <=\n - =\n - >=\n - ISEMPTY\n - ISNOTEMPTY\n- **Reference**\n\nApplicable field: type\n\n - !=\n - =\n - IN\n - ISEMPTY\n - ISNOTEMPTY\n- **String**\n\nApplicable field: value\n\n - !=\n - <=\n - =\n - >=\n - ENDSWITH\n - IN\n - ISEMPTY\n - ISNOTEMPTY\n - LIKE\n - NOT LIKE\n - STARTSWITH\n\nData type: String\n\n |
| \n\nobservable\\_filters.filters.field\\_value\n\n | \n\nValue of the field.For choice fields, the value must be the internal value, not the display value. For date-time fields, the value must be in ISO format in the UTC timezone.\n\n**Note:** This parameter isn’t required when using the ISEMPTY or ISNOTEMPTY operators.\n\nData type: String\n\n |
| \n\npage\\_size\n\n | \n\nLimits the number of observables that are returned in the API response. Used for pagination.Data type: String\n\nDefault: 100\n\nMaximum value: 1000\n\n |
| \n\npage\\_token\n\n | \n\nUsed to get observables data for the current page.To get the first page, this parameter can be omitted or the value for this parameter must be an empty string. To get the next page in the following request, use the **next\\_page\\_token** value from the response body as the value for this parameter.\n\nData type: String\n\nDefault: Empty string\n\n |
| \n\nrelationships\n\n | \n\nRelationship types to return for each observable in the response. The relationships can be with another observable, an observable reference, or a Structured Threat Information Expression \\(STIX\\) object.\n\nValid values:\n\n- attack\\_pattern\n- campaign\n- course\\_of\\_action\n- data\\_component\n- data\\_source\n- grouping\n- identity\n- incident\n- indicator\n- infrastructure\n- intrusion\\_set\n- location\n- malware\n- malware\\_analysis\n- note\n- observable\n- observed\\_data\n- opinion\n- reference\n- report\n- threat\\_actor\n- tool\n- vulnerability\n\nFor example, passing the array `[\"observable\", \"threat_actor\"]` returns all related observables and threat actors for each observable in the response.\n\nData type: Array\n\nDefault: Empty array \\(no relationships returned\\)\n\n |
| \n\nStatus code\n\n | \n\nDescription\n\n |
|---|---|
| \n\n200\n\n | \n\nSuccessful. The request was successfully processed.\n\n |
| \n\n400\n\n | \n\nBad request. The request parameters are invalid or the request body JSON has a syntactical error.To view details about the error, see the **error** parameter in the response body.\n\n |
| \n\n401\n\n | \n\nUnauthorized. The user authentication is invalid. Check the user name and password or OAuth token.\n\n |
| \n\n403\n\n | \n\nForbidden. The calling user is missing a required role. The sn\\_sec\\_tisc.api\\_obs\\_read\\_access role is required to access this endpoint.\n\n |
| \n\n429\n\n | \n\nToo many requests. The number of API requests exceeds the rate limit for the API. By default, the limit is 500 requests per hour.\n\n |
| \n\n500\n\n | \n\nInternal server error. Check application logs in the Log \\[syslog\\] table for more information about the error.\n\n |
| \n\nName\n\n | \n\nDescription\n\n |
|---|---|
| \n\nerror\n\n | \n\nError information. This parameter is only returned if the request failed.Data type: Object\n\n```\n\"error\": {\n \"message\": \"String\",\n \"detail\": \"String\"\n}\n```\n\n |
| \n\nerror.message\n\n | \n\nError message containing the reason the request failed.Data type: String\n\n |
| \n\nerror.detail\n\n | \n\nAdditional details about why the request failed.Data type: String\n\n |
| \n\nis\\_last\\_page\n\n | \n\nFlag that indicates whether this is the last page of observables data.Valid values:\n\n- true: This response contains the last page of data.\n- false: There are additional pages that can be returned.\n\nData type: Boolean\n\n |
| \n\nnext\\_page\\_token\n\n | \n\nUse this value in the next API request to get the next page of observables data. Provide this value in the **page\\_token** parameter in the request body.Data type: String\n\n |
| \n\nobservables\n\n | \n\nObservables objects. Data type: Array of Objects\n\n```\n\"observables\": [\n {\n \"attributes\": {Object},\n \"relationships\": {Object},\n \"sys_id\": \"String\",\n \"type\": \"String\",\n \"value\": \"String\"\n }\n]\n```\n\nEach observables object also includes the fields specified by the **included\\_fields.observable.common\\_fields** parameter in the request body.\n\n |
| \n\nobservables.attributes\n\n | \n\nName-value pairs for the fields specified by the **included\\_fields.observable.attributes.<observable\\_type>** parameter in the request body.Data type: Object\n\n```\n\"attributes\": {\n \" |
| \n\nobservables.relationships\n\n | \n\nRelationships for the observable. The types of relationships returned are specified by the **relationships** parameter in the request body, and the fields returned for each relationship are specified by the **included\\_fields** parameter in the request body.This example shows the basic structure of this parameter. However, the relationship types and fields returned vary based on the request body parameters.\n\nData type: Object\n\n```\n\"relationships\": {\n \"observable\": [\n {\n \"sys_id\": \"String\",\n \"type\": \"String\",\n \"value\": \"String\"\n }\n ],\n \"indicator\": [\n {\n \"id\": \"String\",\n \"name\": \"String\",\n \"sys_id\": \"String\"\n }\n ],\n \"attack_pattern\": [\n {\n \"id\": \"String\",\n \"name\": \"String\",\n \"sys_id\": \"String\"\n }\n ]\n}\n```\n\n |
| \n\nobservables.sys\\_id\n\n | \n\nSys\\_id of the observable.Data type: String\n\nTable: Observable \\[sn\\_sec\\_tisc\\_observable\\]\n\n |
| \n\nobservables.type\n\n | \n\nType of observable. For a complete list of valid observable types, see the **Value** field in the Observable Type \\[sn\\_sec\\_tisc\\_observable\\_type\\] table.Data type: String\n\n |
| \n\nobservables.value\n\n | \n\nValue associated with the observable, such as an IP address or URL.Data type: String\n\n |
| \n\norigin\n\n | \n\nOrigin application of the response, which is Threat Intelligence Security Center \\(TISC\\). The value of this parameter is `sn_sec_tisc`.This value can optionally be used by SIEMs consuming the API response to trace whether the intelligence from TISC resulted in the creation of security incidents.\n\nData type: String\n\n |
| \n\npage\\_size\n\n | \n\nMaximum number of observables returned in the response. Used for pagination.Data type: String\n\n |
| \n\nstatus\n\n | \n\nStatus of the API request.Possible values:\n\n- failure\n- success\n\nIf the request failed, see the **error** parameter in the response body for more information about the error.\n\nData type: String\n\n |