Sign in
activity

Create Activity

Changed on

Create a new activity for an assessment.

post/api/v1/assessments/{assessment_id}/activity/

Request

  • The document declares no server URL.
  • Auth: OAuth 2 (password, token URL /api/v1/auth/token)

Path parameters

assessment_idstring uuid required

Request body

namestring required
mitre_tacticstring required
mitre_techniquestring required

Example request

{
  "mitre_tactic": "TA0002",
  "mitre_technique": "T1204.001",
  "name": "Windows: Malicious Link Execution on Client"
}

Response

Successful Response

namestring required
mitre_tacticstring required
mitre_techniquestring required
providerstring nullable
visibleboolean
priority'Low' | 'Medium' | 'High' | 'Critical'

Possible activity priority levels

state'Pending' | 'Waiting Red' | 'Waiting Blue' | 'Ready' | 'In Progress' | 'In Evaluation' | 'Completed' | 'Cancelled' required

Possible activity state levels

activity_group_idstring uuid nullable
updated_atstring date-time nullable
activity_rationalestring nullable
activity_actionsstring nullable
activity_requirementsstring nullable
activity_notesstring nullable
activity_start_timestring date-time nullable
activity_end_timestring date-time nullable
expected_loggingboolean nullable
expected_preventionboolean nullable
expected_alert_creationboolean nullable
expected_stakeholder_notificationboolean nullable
expected_severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical'

Possible activity severity levels

loggedboolean nullable
log_timestring date-time nullable
preventedboolean nullable
prevent_timestring date-time nullable
alertedboolean nullable
alert_severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical'

Possible activity severity levels

alert_timestring date-time nullable
stakeholder_notification_createdboolean nullable
stakeholder_notification_severity'Informational' | 'Low' | 'Medium' | 'High' | 'Critical'

Possible activity severity levels

stakeholder_notification_timestring date-time nullable
linked_knowledge_base_articlesstring[] nullable
log_notesstring nullable
alert_notesstring nullable
prevent_notesstring nullable
stakeholder_notification_notesstring nullable
idstring uuid required
deletedboolean required
activity_positioninteger nullable
created_atstring date-time nullable

Example response

{
  "activity_actions": "",
  "activity_end_time": "2026-01-01T11:00:00Z",
  "activity_group_id": "00000000-0000-0000-0000-000000000000",
  "activity_notes": "",
  "activity_position": 1,
  "activity_rationale": "Users or attackers might visit known malicious sites from the system.",
  "activity_requirements": "Standard Windows workplace with Internet access.",
  "activity_sources": "",
  "activity_start_time": "2026-01-01T10:00:00Z",
  "activity_targets": "",
  "activity_tools": "",
  "alert_notes": "",
  "alert_severity": "Low",
  "alert_sources": [
    "77777777-7777-7777-7777-777777777777"
  ],
  "alert_time": "2026-01-01T10:35:00Z",
  "alerted": false,
  "deleted": false,
  "evaluation": {
    "activity_coverage_score": 100,
    "alert_severity_applicable": true,
    "alert_severity_data": "2026-01-01T10:00:00Z",
    "alert_severity_evaluation": true,
    "alert_to_stakeholder_applicable": true,
    "alert_to_stakeholder_data": "2026-01-01T10:00:00Z",
    "alert_to_stakeholder_evaluation": true,
    "alerted_evaluation": true,
    "dynamic_questions": [
      {
        "applicable": true,
        "data": "Dynamic question data",
        "evaluation": true,
        "evaluation_template_id": "00000000-0000-0000-0000-000000000000",
        "position": 1
      }
    ],
    "event_to_alert_applicable": true,
    "event_to_alert_data": "2026-01-01T10:00:00Z",
    "event_to_alert_evaluation": true,
    "logged_evaluation": true,
    "prevented_evaluation": true,
    "stakeholder_notification_severity_applicable": true,
    "stakeholder_notification_severity_data": "2026-01-01T10:00:00Z",
    "stakeholder_notification_severity_evaluation": true,
    "stakeholder_notified_evaluation": true
  },
  "expected_alert_creation": true,
  "expected_prevention": true,
  "expected_severity": "Medium",
  "expected_stakeholder_notification": false,
  "id": "00000000-0000-0000-0000-000000000000",
  "linked_knowledge_base_articles": [
    "88888888-8888-8888-8888-888888888888"
  ],
  "log_notes": "",
  "log_sources": [
    "55555555-5555-5555-5555-555555555555"
  ],
  "logged": false,
  "mitre_tactic": "TA0002",
  "mitre_technique": "T1204.001",
  "name": "Windows: Malicious Link Execution on Client",
  "prevent_notes": "",
  "prevent_time": "2026-01-01T10:30:00Z",
  "prevented": false,
  "prevention_sources": [
    "66666666-6666-6666-6666-666666666666"
  ],
  "priority": "Medium",
  "provider": "Compass Security",
  "sources": [
    "22222222-2222-2222-2222-222222222222",
    "22222222-2222-2222-2222-333333333333"
  ],
  "stakeholder_notification_created": false,
  "stakeholder_notification_notes": "",
  "stakeholder_notification_severity": "Low",
  "stakeholder_notification_sources": [
    "88888888-8888-8888-8888-888888888888"
  ],
  "stakeholder_notification_time": "2026-01-01T10:40:00Z",
  "state": "Pending",
  "tags": [
    "11111111-1111-1111-1111-111111111111"
  ],
  "targets": [
    "33333333-3333-3333-3333-333333333333"
  ],
  "tools": [
    "44444444-4444-4444-4444-444444444444"
  ],
  "visible": false
}

Changes