Cisco Threat Response - Create Sighting
Details
This atomic belongs to the Cisco Threat Response atomic group.
Creates a new Threat Response sighting in your private intelligence store.
Target: SecureX Private Intelligence API or HTTP Endpoint for "private.intel.amp.cisco.com"
Account Key: None (uses a token)
Steps:
[] Generate the JSON for the new sighting
[] Generate the authorization header
[] POST the sighting JSON to Threat Response
[] Check if the sighting was created:
[]> If it was, extract the sighting ID and set the output variable
[]> If it wasn't, return an error
More information about this API: https://private.intel.amp.cisco.com/index.html#/Sighting/post_ctia_sighting
About
Authorship
Cisco Managed