MImisp
Galaxy Clusters

Add galaxy cluster

Changed on
post/galaxy_clusters/add/{galaxyId}

Request

  • Base URL
    https://misp.local
  • URL
    https://misp.local/galaxy_clusters/add/{galaxyId}
  • Auth
    API key in header Authorization

Path parameters

string required
OR
string uuid required
Example:12345

UUID or numeric ID of the galaxy

Request body

idstring
uuidstring uuid
collection_uuidstring uuid
typestring
valuestring
tag_namestring
descriptionstring
galaxy_idstring
sourcestring
authorsstring[]
versionstring nullable
distribution'0' | '1' | '2' | '3' | '4' | '5'

Who will be able to see this event once it becomes published and eventually when it becomes pulled:

  • 0 - Your organization only
  • 1 - This community only
  • 2 - Connected communities
  • 3 - All communities
  • 4 - Sharing group
  • 5 - Inherit Event
org_idstring
orgc_idstring
defaultboolean
lockedboolean
extends_uuidstring nullable
extends_versionstring nullable
publishedboolean
deletedboolean

Example request

{
  "id": "12345",
  "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "type": "mitre-enterprise-attack-attack-pattern",
  "value": "Brute Force - T1110",
  "tag_name": "tlp:white",
  "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
  "galaxy_id": "12345",
  "source": "https://github.com/mitre/cti",
  "authors": [
    "MITRE"
  ],
  "version": "1",
  "distribution": "4",
  "sharing_group_id": "1",
  "org_id": "12345",
  "orgc_id": "12345",
  "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
  "extends_version": "1",
  "GalaxyElement": [
    {
      "id": "12345",
      "galaxy_cluster_id": "12345",
      "key": "categories",
      "value": "Military"
    }
  ]
}

Response

Galaxy cluster by ID response

Example response

{
  "GalaxyCluster": {
    "id": "12345",
    "uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "collection_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "type": "mitre-enterprise-attack-attack-pattern",
    "value": "Brute Force - T1110",
    "tag_name": "tlp:white",
    "description": "Adversaries may use brute force techniques to attempt access to accounts when passwords are unknown or when password hashes are obtained...",
    "galaxy_id": "12345",
    "source": "https://github.com/mitre/cti",
    "authors": [
      "MITRE"
    ],
    "version": "1",
    "distribution": "4",
    "sharing_group_id": "1",
    "org_id": "12345",
    "orgc_id": "12345",
    "extends_uuid": "c99506a6-1255-4b71-afa5-7b8ba48c3b1b",
    "extends_version": "1",
    "GalaxyElement": [
      {
        "id": "12345",
        "galaxy_cluster_id": "12345",
        "key": "categories",
        "value": "Military"
      }
    ]
  }
}

Changes

  • 0a9c9382121aRevision changes
    • breaking

      the request property //// became not nullable

    • breaking

      the //// request property type changed from string to no type

    • breaking

      the ///// response property's maxLength was unset from 10 for the response status

    • breaking

      added to the ///// response property oneOf list for the response status

    • breaking

      the ///// response's property type changed from string to no type for status

    • info

      added to the //// request property oneOf list

    • info

      removed the pattern ^\d+$|^$ from the request property ////

    • info

      the ///// response's property pattern ^\d+$|^$ was removed for the status

  • 787ec8b667aaRevision changes
    • breaking

      the ///// response property's maxLength was unset from 36 for the response status

    • breaking

      the ///// response property's maxLength was unset from 36 for the response status