Case Management

Create an Observable

Adds a new Observable record.

post/workspace/{ws_id}/case_management/table/observables

Request

Base URL
https://your-tenant.app.blinkops.com/api/v1
URL
https://your-tenant.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/observables
Auth
API key in header BLINK-API-KEY

Path parameters

ws_idstring required

Workspace ID

Request body /

contentstring

descriptionstring

enrichment_datastring

namestring

reputation'Unknown' | 'Very Safe' | 'Safe' | 'Probably Safe' | 'Leans Safe' | 'May not be Safe' | 'Exercise Caution' | 'Suspicious/Risky' | 'Possibly Malicious' | 'Probably Malicious' | 'Malicious' | 'Other'

type'Unknown' | 'Hostname' | 'IP Address' | 'MAC Address' | 'User Name' | 'Email Address' | 'URL String' | 'File Name' | 'Hash' | 'Process Name' | 'Resource UID' | 'Port' | 'Subnet' | 'Command Line' | 'Country' | 'Process ID' | 'HTTP User-Agent' | 'CWE Object: uid' | 'CVE Object: uid' | 'User Credential ID' | 'Endpoint' | 'User' | 'Email' | 'Uniform Resource Locator' | 'File' | 'Process' | 'Geo Location' | 'Container' | 'Registry Key' | 'Registry Value' | 'Fingerprint' | 'Other'

Example request

{
  "content": "1.1.1.1",
  "description": "Suspicious IP address observed in network traffic",
  "enrichment_data": "{\"VirusTotal-Score\":\"value\"}",
  "name": "Suspicious IP Address",
  "reputation": "Suspicious/Risky",
  "type": "IP Address"
}

Response

OK

contentstring

descriptionstring

enrichment_datastring

namestring

reputation'Unknown' | 'Very Safe' | 'Safe' | 'Probably Safe' | 'Leans Safe' | 'May not be Safe' | 'Exercise Caution' | 'Suspicious/Risky' | 'Possibly Malicious' | 'Probably Malicious' | 'Malicious' | 'Other'

type'Unknown' | 'Hostname' | 'IP Address' | 'MAC Address' | 'User Name' | 'Email Address' | 'URL String' | 'File Name' | 'Hash' | 'Process Name' | 'Resource UID' | 'Port' | 'Subnet' | 'Command Line' | 'Country' | 'Process ID' | 'HTTP User-Agent' | 'CWE Object: uid' | 'CVE Object: uid' | 'User Credential ID' | 'Endpoint' | 'User' | 'Email' | 'Uniform Resource Locator' | 'File' | 'Process' | 'Geo Location' | 'Container' | 'Registry Key' | 'Registry Value' | 'Fingerprint' | 'Other'

Example response

{
  "content": "1.1.1.1",
  "description": "Suspicious IP address observed in network traffic",
  "enrichment_data": "{\"VirusTotal-Score\":\"value\"}",
  "name": "Suspicious IP Address",
  "reputation": "Suspicious/Risky",
  "type": "IP Address"
}

Changes

No recorded changes to this operation across all 2 revisions of this API.