Threats

# Custom Action Keyword

Generates the detection keyword (query) for a custom action based on the given attack module and its related fields (file hashes, file name, play process ids, url or action id). The returned keyword can then be passed to the Create Action endpoint.

post/v1/threat-library/actions/custom-keyword

Request body

action_idinteger

Action id (data exfiltration / email modules)

file_namestring

File name (file-based modules)

md5string

MD5 hash of the file

modulestring

Attack module the action belongs to

play_processinteger[]

Play process ids (endpoint modules)

sha1string

SHA1 hash of the file

sha256string

SHA256 hash of the file

urlstring

URL (URL Filtering module)

Response

CustomActionKeywordReturnResponse

keywordstring

Changes

No recorded changes to this endpoint across all 4 revisions of this API.