openapi: 3.0.0
info:
  title: CyberProof Platform API
  description: 'The CyberProof Platform public API, enabling integration with customer systems.'
  version: 2.21.3
  contact:
    name: CyberProof API Support
    email: support@cyberproof.com
servers:
  - url: 'https://test-api.cyberproof.io/api/v1'
    description: API test server
  - url: 'https://{tenant}.api.cyberproof.io/api/v1'
    description: Tenant-specific API endpoint
    variables:
      tenant:
        default: demo
        description: The name of the tenant
components:
  headers:
    ETag:
      schema:
        type: string
      description: Includes an identifier for a specific version of a resource. Commonly used as the basis for conditional gets and conditional updates.
    Location:
      schema:
        type: string
        format: uri
      description: |
        The absolute URI of the newly-created resource.
        Note: this URI points at the actual resource, not a GUI URI.
  schemas:
    CreateAlertRequest:
      type: object
      properties:
        name:
          type: string
          description: The name of the alert
          example: Email messages containing malware removed after delivery
        sourceId:
          type: string
          description: 'The identifier of the alert, as it appears in the source system. In most cases this would be the ID as it appears in the SIEM. It cannot exceed 400 characters.'
          example: 345ffe9a
          maxLength: 400
        severity:
          type: string
          description: The severity of the alert. Must be one of the severities defined in CDC.
          example: High
        description:
          type: string
          maxLength: 5000
          description: 'The description of the alert. It cannot exceed 5000 characters when exceeds, the request will not fail but description will be truncated.'
          example: message containing malware are delivered to mailboxes in your organization. Office 365 removed the infected messages from Exchange Online mailboxes.
        sourceUrl:
          type: string
          format: uri
          description: The source URL of the alert in the SIEM or in the origin system
          example: 'http://10.0.0.90/MySIEM/api/alerts/345ffe9a'
        raw:
          type: object
          description: 'Alert raw data, as provided by the SIEM or source system.<br/>**NOTE\:** object''s keys cannot start with `$` nor contain `.` characters.'
          example:
            attributeInitializationInProgress: false
            createdTime:
              day:
                numberInt: '18'
              hour:
                numberInt: '16'
              milliSecond:
                numberInt: '711'
              minute:
                numberInt: '10'
              month:
                numberInt: '6'
              second:
                numberInt: '47'
              timezoneID: Israel
              year:
                numberInt: '2017'
            createdTimestamp:
              numberDouble: '1500383447711'
            deprecated: false
            description: ACME
            disabled: false
            inCache: true
            inactive: false
            initialized: true
            isAdditionalLoaded: false
            localID:
              numberDouble: '30064798760'
            modificationCount:
              numberInt: '1'
        classification:
          type: string
          maxLength: 50
          description: Classification category that the alert falls into.
          example: Authentication
        observables:
          type: array
          description: The observables associated with this alert
          items:
            type: object
            properties:
              type:
                description: The type of the observable
                type: string
                example: IPv4 Address
              value:
                description: The value of the observable
                type: string
                example: 192.168.40.45
              tags:
                $ref: '#/components/schemas/Tags'
              extraProperties:
                type: object
                description: observable additional properties
                additionalProperties:
                  type: object
                  required:
                    - value
                  properties:
                    value:
                      anyOf:
                        - type: string
                        - type: number
                        - type: boolean
                        - type: array
                          items:
                            type: string
                        - type: array
                          items:
                            type: number
                        - type: array
                          items:
                            type: boolean
                    type:
                      type: string
                  example:
                    value: aaa-bbcc
                    type: WeakIdentifier
              relatedExtraProperties:
                type: object
                description: additional properties of observable alert relation
                additionalProperties:
                  type: object
                  required:
                    - value
                  properties:
                    value:
                      anyOf:
                        - type: string
                        - type: number
                        - type: boolean
                        - type: array
                          items:
                            type: string
                        - type: array
                          items:
                            type: number
                        - type: array
                          items:
                            type: boolean
                    type:
                      type: string
                  example:
                    sha: 256
                    type: WeakIdentifier
            required:
              - type
              - value
        useCase:
          type: string
          description: Alert use case
          example: UC216 - EPP - Persistent Malware
        company:
          type: string
          description: The company with which this alert is associated
          example: ACME
        tags:
          $ref: '#/components/schemas/Tags'
        categories:
          $ref: '#/components/schemas/Categories'
        detectionRule:
          type: string
          description: Name of detection rule from SIEM that triggered the generation of alert. It cannot exceed 256 characters.
          example: WRONG_PASSWORD_3_ATTEMPTS
          maxLength: 256
        alertType:
          type: string
          description: 'The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.'
          maxLength: 15
          example: CTI-Landscape
          enum:
            - CTI-Landscape
            - CTI-Assetbased
            - General
        threatType:
          type: string
          description: The threat type with which this alert is associated.
          maxLength: 50
          example: Phishing
        threatActors:
          type: array
          description: 'The attacker, whoever launched the attack/campaign/malware.'
          example:
            - Cyber Criminals
            - Anonymous
          items:
            type: string
            maxLength: 200
        malwareTools:
          type: array
          description: The Malware/Tools that were used in the attack.
          example:
            - TrickBot
            - IcedID
            - Cobalt Strike
          items:
            type: string
            maxLength: 200
        ctiSourceUrls:
          type: array
          description: The data source that was used for opening the alert.
          example:
            - 'https://blog.malwarebytes.com/someTopic'
          items:
            type: string
            maxLength: 2000
        recommendations:
          type: string
          description: Instruction how to handle alert.
          maxLength: 3000
          example: Implement the attached IOCs in your security systems.
        killChain:
          type: array
          description: |
            Mapping of alert to specific Kill Chain phases.
            The case of the names will be ignored, as well as spaces and duplicate values.
            All values will be normalized accroding to the provided enum.
            See in [Wikipedia](https://en.wikipedia.org/wiki/Kill_chain#The_cyber_kill_chain)

            This field accepts any value; the provided enum shows the recommended values.
          example:
            - Reconnaissance
            - Weaponization
            - Delivery
          items:
            type: string
            maxLength: 256
            enum:
              - Reconnaissance
              - Weaponization
              - Delivery
              - Exploitation
              - Installation
              - Command and Control
              - Actions on Objective
        mitreAttacks:
          $ref: '#/components/schemas/MitreAttacks'
      required:
        - sourceId
        - name
        - description
        - severity
    AlertsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/AlertSummary'
      required:
        - results
    IncidentSummary:
      required:
        - id
        - key
        - created
        - updated
        - type
        - status
        - priority
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this incident'
        key:
          type: string
          description: 'A unique, human-oriented key identifying this incident'
          example: CDC-20191208-00046
        name:
          type: string
          description: The name of the incident. Included only if the client specified it explicitly in the "include" parameter
          example: Web Proxy - Execution file download
        description:
          type: string
          description: The incident description. Included only if the client specified it explicitly in the "include" parameter
          example: |
            Customer Name - ACME Inc<br>Alert Name - Web Proxy - Execution file download<br>Device Product - Web Gateway<br>Category Outcome - /Failure<br>
        created:
          type: string
          description: The time when the incident was created
          format: date-time
        updated:
          type: string
          description: The time when the incident was last updated
          format: date-time
        type:
          type: string
          description: Incident type
          example: DDOS
        status:
          type: string
          description: The status of the incident
          example: Closed
        priority:
          type: string
          description: The priority of the incident
          example: Low
        group:
          type: string
          description: The group to which this incident is currently assigned
          example: L1
        externalIds:
          $ref: '#/components/schemas/ExternalIds'
        tags:
          $ref: '#/components/schemas/Tags'
        company:
          type: string
          description: The company with which this incident is associated
          example: ACME Europe
        pendingForGroup:
          type: string
          description: If this incident was redirected to a different group this will contain the name of the target group
        redirectionReason:
          type: string
          description: If this incident was redirected to a different group this will contain the user comment provided with redirection request
        endSlaDate:
          type: string
          format: date-time
          nullable: true
          description: Service level agreement end date
          example: '2019-08-23T14:15:22Z'
    ExternalIds:
      type: array
      description: 'Array of external identifiers of the entity. Clients will only receive identifiers they have permission for, and won''t be able to see identifiers of other systems.'
      items:
        type: object
        properties:
          system:
            type: string
            example: ServiceNow
          id:
            type: string
            example: 40385fee
        required:
          - system
          - id
    Tags:
      type: array
      description: |
        Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.

        Tags are case-reserving on insertion: if a tag doesn't already exist with a different casing style, the tag will be saved with the casing specified.
        When used as query filters, tags are treated as case-insensitive.
      example:
        - Cloud-Computing
        - Virus
        - Phishing
      items:
        type: string
        pattern: ^\S*$
    Categories:
      type: array
      description: Mapping of alert to specific category in SIEM
      example:
        - Ransomware
        - Phishing
      items:
        type: string
    Alert:
      type: object
      allOf:
        - $ref: '#/components/schemas/AlertSummary'
        - type: object
          properties:
            raw:
              type: object
              description: The alert raw data.
              example:
                attributeInitializationInProgress: false
                createdTime:
                  day:
                    numberInt: '18'
                  hour:
                    numberInt: '16'
                  milliSecond:
                    numberInt: '711'
                  minute:
                    numberInt: '10'
                  month:
                    numberInt: '6'
                  second:
                    numberInt: '47'
                  timezoneID: Israel
                  year:
                    numberInt: '2017'
                createdTimestamp:
                  numberDouble: '1500383447711'
                deprecated: false
                description: ACME
                disabled: false
                inCache: true
                inactive: false
                initialized: true
                isAdditionalLoaded: false
                localID:
                  numberDouble: '30064798760'
                modificationCount:
                  numberInt: '1'
            appendedRaw:
              type: array
              description: The alert appended raw data.
              items:
                type: object
            cdcUrl:
              type: string
              format: uri
              description: The URL of this alert in the CDC application.
              example: 'https://acme.cyberproof.io/home/alerts/alert/5e7c6cf54b832e0018f191ad'
            threatActors:
              type: array
              items:
                type: string
              description: 'The attacker, whoever launched the attack/campaign/malware.'
              example:
                - Cyber Criminals
                - Anonymous
            malwareTools:
              type: array
              items:
                type: string
              description: The Malware/Tools that were used in the attack.
              example:
                - TrickBot
                - IcedID
                - Cobalt Strike
            ctiSourceUrls:
              type: array
              items:
                type: string
              description: The data source that was used for opening the alert.
              example:
                - 'https://blog.malwarebytes.com/someTopic'
            recommendations:
              type: string
              description: Instruction how to handle alert.
              example: Implement the attached IOCs in your security systems.
          required:
            - cdcUrl
    Incident:
      type: object
      allOf:
        - $ref: '#/components/schemas/IncidentSummary'
        - type: object
          properties:
            closingComment:
              type: string
              description: The specified comment when it was closed. Only present if the incident was closed.
            closingReason:
              $ref: '#/components/schemas/IncidentClosingReason'
            closed:
              type: string
              format: date-time
              description: Timestamp specifying when the incident was closed.
            cdcUrl:
              type: string
              format: uri
              description: The URL of this incident in the CDC application.
              example: 'https://acme.cyberproof.io/home/incidents/incident/5ea71bb363f6c6001707663b'
          required:
            - cdcUrl
    IncidentsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/IncidentSummary'
      required:
        - results
    IncidentAlertsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: A continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/Alert'
      required:
        - results
    IncidentAlertIdsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            type: string
          description: alert IDs associated with this incident
      required:
        - results
    IncidentObservablesQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: A continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/ObservableSummary'
      required:
        - results
    EvidenceQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: A continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/Evidence'
      required:
        - results
    CreateIncidentMessageRequest:
      type: object
      properties:
        externalId:
          type: string
          description: 'The identifier of the message, as it appears in external systems, mostly used to achieve idempotence'
          example: 345ffe9a
        contentType:
          type: string
          enum:
            - text
          description: 'The type of the content, currently only ''text'' is supported'
          example: text
        content:
          type: string
          description: The content of the message
          example: Requires further investigation
        evidence:
          type: object
          description: 'When specified, the message is marked as evidence'
          properties:
            caption:
              type: string
              description: The caption of the evidence
              example: Severity changed
            reported:
              type: string
              format: date-time
              description: The time when this evidence was supposed to be reported
            description:
              type: string
              description: The description of this evidence
              example: System Admin has changed severity from Low to Medium
          required:
            - caption
      required:
        - externalId
        - contentType
        - content
    IncidentMessageSummary:
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this message'
          example: 5e7c6cf54b832e0018f191ad
        text:
          type: string
          description: The text of the message
          example: Requires further investigation
        processedText:
          type: string
          description: The processed text of the message
          example: Requires further investigation
      required:
        - id
        - text
    CreateIncidentObservableRequest:
      type: object
      properties:
        type:
          description: The type of the observable
          type: string
          example: IPv4 Address
        value:
          description: The value of the observable
          type: string
          example: 192.168.40.45
        tags:
          type: array
          description: |
            Array of tags. A tag's name can contain only the next symbols: alphabetic, "-", "_", ".", "#", "@", and numeric.
          example:
            - Critical-Infrastructure
          items:
            type: string
            pattern: ^\S*$
      required:
        - type
        - value
    CloseIncidentRequest:
      type: object
      properties:
        closingComment:
          type: string
          description: The closing comment for this incident
          example: 'Virus removed, performed AntiVirus software update, ensured the AntiVirus detects and quarantines emails with the virus attached'
        closingReason:
          $ref: '#/components/schemas/IncidentClosingReason'
        shouldTerminatePlaybooks:
          type: boolean
          description: |
            Terminate playbooks parameter

            Possible values:
            - **true** - will terminate all running playbooks in the alerts within the incident and change status(es) and close the incident/alert(s)
            - **false** (default) - close incident if there are no running playbooks, else - close incident flow will be canceled
          example: true
      required:
        - closingComment
    IncidentClosingReason:
      type: string
      description: |
        Incident closure reason
        Possible default values are: "Benign Positive", "True Positive", "False Positive - Incorrect alert logic", "False Positive - Inaccurate data" and "Undetermined"

        *Notice:* There could be an additional possible custom reasons, but *only if such exist at CDC (metamodels)*
      example: True Positive
    UpdateIncidentRequest:
      type: object
      properties:
        priority:
          type: string
          description: The priority of the incident
          example: Low
        tags:
          $ref: '#/components/schemas/Tags'
        company:
          type: string
          description: The company with which the incident is associated
    RedirectIncidentRequest:
      type: object
      properties:
        targetGroup:
          type: string
          description: The group to which the incident is being redirected
        reason:
          type: string
          description: a user-provided reason for redirection
      required:
        - targetGroup
        - reason
    ObservableSummary:
      required:
        - id
        - type
        - value
        - created
        - updated
        - suspiciousRate
        - tags
        - enrichments
        - isIoc
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of this observable
          example: 5e13b88122c957000787db06
        type:
          description: The type of the observable
          type: string
          example: IPv4 Address
        isIoc:
          description: is this observable an indicator of compromise?
          type: boolean
          example: false
        value:
          description: The value of the observable
          type: string
          example: 192.168.40.45
        created:
          type: string
          description: The time when the observable was created
          format: date-time
        updated:
          type: string
          description: 'The time when the observable was last updated, including changes to the observable and association to incidents.'
          format: date-time
        suspiciousRate:
          type: number
          nullable: true
          description: |
            The suspicious rate of the observable (higher is more suspicious), between 0 and 100
            This field is Nullable.
            Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
          format: double
          example: 3.2
        tags:
          type: array
          description: The tags associated with this observable
          example:
            - Critical-Infrastructure
          items:
            type: string
            pattern: ^\S*$
        enrichments:
          type: array
          description: The recent and valid enrichments associated with this observable
          items:
            $ref: '#/components/schemas/EnrichmentSummary'
    ObservablesQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: A continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/ObservableSummary'
      required:
        - results
    ObservableAlertIdsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            type: string
          description: alert IDs associated with this observable
      required:
        - results
    ObservableIncidentIdsQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            type: string
          description: incident IDs associated with this observable
      required:
        - results
    EnrichmentSummary:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of this enrichment
          example: 5e13b88122c957000787db06
        name:
          description: The name of the enrichment
          type: string
          example: VirusTotal
        reported:
          type: string
          format: date-time
          description: The time when this enrichment was reported
        suspiciousRate:
          type: number
          nullable: true
          description: |
            The suspicious rate of the observable (higher is more suspicious), between 0 and 100
            This field is Nullable.
            Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
          format: double
          example: 3.2
      required:
        - id
        - name
        - reported
        - suspiciousRate
    Evidence:
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this evidence.'
          example: 5aa4d8fcbdee5a000a911882
        type:
          type: string
          description: The type of evidence
          example: MITRE_ATTACK_ADDED
          enum:
            - TEXT
            - ALERT_OWNER_ASSIGNED
            - ALERT_OWNER_REMOVED
            - ALERT_STATUS_CHANGED
            - ALERT_ATTACHED_TO_INCIDENT
            - ALERT_AUTOMATION_JOB_ENDED
            - ALERT_AUTOMATION_JOB_STARTED
            - ALERT_CLOSED
            - ALERT_DETACHED_FROM_INCIDENT
            - ALERT_DETECTED
            - ALERT_RESOLVED
            - ALERT_INCIDENT_CREATED
            - ALERT_PLAYBOOK_STEP_COMPLETED
            - ALERT_REOPENED
            - MITRE_ATTACK_ADDED
            - MITRE_ATTACK_REMOVED
            - INCIDENT_ALERT_ADDED
            - INCIDENT_ALERT_REMOVED
            - INCIDENT_CREATED
            - INCIDENT_CLOSED
            - INCIDENT_REOPENED
            - INCIDENT_STATUS_CHANGED
            - INCIDENT_COMPANY_CHANGED
            - INCIDENT_SEVERITY_CHANGED
            - INCIDENT_PRIORITY_CHANGED
            - INCIDENT_TYPE_CHANGED
            - INCIDENT_OWNER_CHANGED
            - INCIDENT_ESCALATED
            - INCIDENT_ESCALATION_REVOKED
            - INCIDENT_ESCALATION_ACCEPTED
            - INCIDENT_ESCALATION_REMINDER_SENT
            - PLAYBOOK_ADDED
            - PLAYBOOK_STEP_COMPLETED
            - PLAYBOOK_USER_INPUT_REQUIRED
            - PLAYBOOK_EVIDENCES_PROVIDED
            - PLAYBOOK_TERMINATED
        reported:
          type: string
          format: date-time
          description: The time when this evidence was reported
        created:
          type: string
          format: date-time
          description: The time when this evidence was created
        caption:
          type: string
          description: The caption of the evidence
          example: Severity changed
        description:
          type: string
          description: The description of this evidence
          example: System Admin has changed severity from Low to Medium
        messageId:
          type: string
          description: The ID of the message this evidence was created from
        messageCdcUrl:
          type: string
          description: The URL of the message in the CDC application that this evidence was created from.
          example: 'https://acme.cyberproof.io/home/incidents/5ea71bb363f6c6001707663b/evidence/5ea71bb363f6c6001707254a'
        externalId:
          type: string
          description: 'The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence'
          example: 345ffe9a
        data:
          type: object
          description: Additional evidence metadata
      required:
        - id
        - type
        - reported
        - created
    CreateEvidenceRequest:
      type: object
      description: |
        **Validations\:**
        * At least one of the following fields should be provided: messageId, description.
        * Only one of the following fields can be provided: messageId, externalId.
      properties:
        reported:
          type: string
          format: date-time
          description: The time when this evidence was reported
        caption:
          type: string
          description: The caption of the evidence
          example: Severity changed
        messageId:
          type: string
          description: The ID of the message this evidence was created from.
        description:
          type: string
          description: The description of this evidence
          example: System Admin has changed severity from Low to Medium
        externalId:
          type: string
          description: 'The identifier of the evidence, as it appears in external systems, mostly used to achieve idempotence'
          example: 345ffe9a
      required:
        - reported
        - caption
    KillChain:
      type: array
      description: |
        Mapping of alert to specific Kill Chain phases.
        See in [Wikipedia](https://en.wikipedia.org/wiki/Kill_chain#The_cyber_kill_chain)
      example:
        - Reconnaissance
        - Weaponization
        - Delivery
      items:
        type: string
        maxLength: 256
        enum:
          - Reconnaissance
          - Weaponization
          - Delivery
          - Exploitation
          - Installation
          - Command and Control
          - Actions on Objective
    MitreAttacks:
      type: array
      description: MitreAttack Ids List
      example:
        - T1003
        - T1001
        - T1595.001
      items:
        type: string
    EntityScope:
      type: object
      description: entities in the system can have a scope defining their assosication with a bussiness object
      properties:
        id:
          type: string
          description: id of the entity as saved in the system
          example: 616ea579f2631c8d4c68a1b7
        type:
          type: string
          description: The type of the entity ( alert / incident / channel ...)
          example: alert
          enum:
            - alert
            - incident
            - channel
      required:
        - id
        - type
    FileScope:
      type: object
      description: entities in the system can have a scope defining their assosication with a bussiness object
      properties:
        id:
          type: string
          description: id of the entity as saved in the system
          example: 616ea579f2631c8d4c68a1b7
        type:
          type: string
          description: The type of the entity ( alert / incident / channel ...)
          example: alert
          enum:
            - alert
            - incident
            - channel
            - visualization
      required:
        - id
        - type
    TextMessageContent:
      type: object
      properties:
        message:
          type: string
          description: the text of the message. can be simple text or rich text
          example: some text <b>bold</b> message
        contentType:
          type: string
          description: Specifies the type of the Message content (Text messages)
          enum:
            - text
      required:
        - message
        - contentType
    AdaptiveCardMessageContent:
      type: object
      properties:
        json:
          type: object
          description: the raw data attached for the porpuse of populating the card
          example: {}
        contentType:
          type: string
          description: Specifies the type of the Message content (Adaptive Card messages)
          enum:
            - adaptiveCard
      required:
        - json
        - contentType
    MessageCreateRequest:
      type: object
      properties:
        externalId:
          type: string
          description: 'The identifier of the message, as it appears in external systems. Only one message can be linked to each unique externalId.'
          example: 111e3cf9-da0e-46a1-b099-3fd2e653ecbd
        scope:
          description: Scope provides association data for this message
          allOf:
            - $ref: '#/components/schemas/EntityScope'
        parentMessageId:
          type: string
          description: 'If provided, the new message will be posted as a child of another message as the last message in it''s thread'
          example: 616ea579f2631c8d4c68a1b7
        attachmentIds:
          type: array
          description: IDs of file attached to this message
          example:
            - 616ea579f2631c8d4c68a1b7
          items:
            type: string
        content:
          description: The content of the message
          oneOf:
            - $ref: '#/components/schemas/TextMessageContent'
      required:
        - externalId
        - scope
        - content
    MessageSummary:
      required:
        - id
        - externalId
        - scope
        - content
      type: object
      properties:
        id:
          type: string
          description: ID of the message as saved in the system
          example: 616ea579f2631c8d4c68a1b7
        externalId:
          type: string
          description: 'The identifier of the message, as it appears in external systems. Only one message can be linked to each unique externalId.'
          example: 111e3cf9-da0e-46a1-b099-3fd2e653ecbd
        scope:
          $ref: '#/components/schemas/EntityScope'
        parentMessageId:
          type: string
          description: 'If present, this message was posted in another message''s thread'
          example: 616ea579f2631c8d4c68a1b7
        attachmentIds:
          type: array
          description: IDs of file attached to this message
          example:
            - 616ea579f2631c8d4c68a1b7
          items:
            type: string
        content:
          description: The content of the message
          oneOf:
            - $ref: '#/components/schemas/TextMessageContent'
            - $ref: '#/components/schemas/AdaptiveCardMessageContent'
    Message:
      type: object
      allOf:
        - $ref: '#/components/schemas/MessageSummary'
        - type: object
          properties:
            attachments:
              type: array
              description: file info objects for attachments. note - empty array means no attachments.
              items:
                $ref: '#/components/schemas/FileInfo'
            content:
              oneOf:
                - $ref: '#/components/schemas/TextMessageContent'
                - $ref: '#/components/schemas/AdaptiveCardMessageContent'
    MessagesQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/MessageSummary'
      required:
        - results
    FileStatus:
      type: string
      description: |
        The status of the file, respecting the upload and sanitaion process.
        Every file should have a status
          * `uploaded` - uploaded but not ready yet, requires additional processing
          * `processing` - being processed by the system, i.e. pending sanitation
          * `verified` - completed sanitation processes, needs to move to final storage location
          * `ready` - completed and made available
          * `failed` - the file upload process has failed, such as when sanitation can't be applied
          * `blocked` - the file sanitation process failed ( i.e. file has malicious content )
      enum:
        - uploaded
        - processing
        - verified
        - ready
        - failed
        - blocked
    FileInfo:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/FileStatus'
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this file.'
          example: 5e7c6cf54b832e0018f191ad
        name:
          type: string
          description: The file name
          example: attachment.txt
        scope:
          $ref: '#/components/schemas/FileScope'
        url:
          type: string
          description: The file url
          example: 'https://someDomain/somePath/attachment.txt'
        size:
          type: number
          description: the file size in bytes
          example: 2680000
        mimeType:
          type: string
          description: |
            The MIME (Multipurpose Internet Mail Extensions) type of the file.
            A two-part identifier for file formats and format contents transmitted on the Internet.
            see more: https://en.wikipedia.org/wiki/Media_type
          example: text/plain
        extension:
          type: string
          description: An identifier specified as a suffix to the name of a file
          example: txt
        createdAt:
          format: date-time
          type: string
          description: File creation timestamp
        createdBy:
          type: string
          description: The ID of the user who created this file.
          example: 8e2c4cf54b832e0018f191ad
        relations:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
              type:
                type: string
                enum:
                  - vega
          description: The relations of the file
          example:
            - type: vega
              id: 8e2c4cf54b832e0018f191ad
      required:
        - status
        - id
        - name
        - scope
        - url
        - size
        - mimeType
        - createdAt
        - createdBy
    FilesQueryResults:
      type: object
      properties:
        nextMarker:
          type: string
          format: byte
          description: a continuation token. Empty if there are no further results
        results:
          type: array
          items:
            $ref: '#/components/schemas/FileInfo'
      required:
        - results
    UploadFileRequest:
      type: object
      description: 'Form data containing relations, password and file fields.'
      properties:
        relations:
          type: string
          description: 'A string representing array of json object where type = relation type, e.g. vega and id = template file id.'
          example: '[{"type": "vega", "id": "5e7c6cf54b832e0018f191ad"}]'
        password:
          type: string
          description: A single password or more separated by a comma.
          example: test123
        file:
          type: string
          format: binary
          description: The binary file stream
    DownloadFileResponse:
      type: string
      format: binary
      description: The binary file stream
    CDCQueryResponse:
      type: object
      properties:
        sort:
          type: array
          items:
            type: object
            properties:
              fieldName:
                type: string
                description: Field name used for sorting query results
                example: string
              desc:
                type: boolean
                description: DESC/ASC value
                example: true
        limit:
          example: 20
          type: integer
        skip:
          example: 0
          type: integer
        items:
          description: 'Array of either Alerts, Incidents, Observables or Messages (Please note, resulting documents property list are controlled by contents of include field in request)'
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/CQLAlertSummary'
              - $ref: '#/components/schemas/CQLIncidentSummary'
              - $ref: '#/components/schemas/CQLObservableSummary'
              - $ref: '#/components/schemas/CQLMessageSummary'
            discriminator:
              propertyName: summaryType
              mapping:
                alert: '#/components/schemas/CQLAlertSummary'
                incident: '#/components/schemas/CQLIncidentSummary'
                observable: '#/components/schemas/CQLObservableSummary'
                message: '#/components/schemas/CQLMessageSummary'
        total:
          example: 32
          description: Total count of query results. **Note** Field is returned only when **includeTotal** in request is sent as true
          type: number
      required:
        - sort
        - limit
        - skip
        - items
    CQLAlertSummary:
      allOf:
        - $ref: '#/components/schemas/BaseAlertSummary'
        - type: object
          properties:
            summaryType:
              type: string
              enum:
                - alert
              description: Discriminator property to distinguish between different responses
            incidentId:
              type: string
              description: Id of related incident
          required:
            - summaryType
    CQLIncidentSummary:
      allOf:
        - $ref: '#/components/schemas/BaseIncidentSummary'
        - type: object
          properties:
            summaryType:
              type: string
              enum:
                - incident
              description: Discriminator property to distinguish between different responses
          required:
            - summaryType
    CQLObservableSummary:
      allOf:
        - $ref: '#/components/schemas/BaseObservableSummary'
        - type: object
          properties:
            enrichments:
              type: array
              description: The recent and valid enrichments associated with this observable
              items:
                allOf:
                  - $ref: '#/components/schemas/EnrichmentSummary'
                  - type: object
                    properties:
                      rawData:
                        type: object
                        additionalProperties: true
                        nullable: true
                        description: |
                          Raw data for enrichment.
                        example:
                          data:
                            prop1: blah
                            prop2: 3
                            prop3: false
            summaryType:
              type: string
              description: Discriminator property to distinguish between different responses
              enum:
                - observable
          required:
            - summaryType
    CQLMessageSummary:
      allOf:
        - $ref: '#/components/schemas/BaseMessageSummary'
        - type: object
          properties:
            summaryType:
              type: string
              description: Discriminator property to distinguish between different responses
              enum:
                - messsage
          required:
            - summaryType
    BaseAlertSummary:
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this alert.'
          example: 5e7c6cf54b832e0018f191ad
        source:
          type: string
          description: The name of the source system
          example: QRadar
        sourceId:
          type: string
          description: The ID of the alert in the source system
          example: 296
        score:
          type: number
          nullable: true
          description: |
            The score of the alert
            This field is Nullable.
            Null value meaning: Not enough data to calculate score, could be updated later.
          format: double
          example: 33.2
        name:
          type: string
          description: The name of the alert
          example: Windows - Multiple failed logins same user same host
        description:
          type: string
          description: The description of the alert
          example: |
            Customer Name - AcmeCo
            Alert Name - Windows - Multiple failed logins same user same host
            Device Vendor - Microsoft
            Device Product - Microsoft Windows
            Device Event Class Id - rule:105
        severity:
          type: string
          description: The severity of the alert
          example: Medium
        created:
          type: string
          format: date-time
          description: Alert creation timestamp
        modified:
          type: string
          format: date-time
          description: Last modification timestamp
        detected:
          type: string
          format: date-time
          description: Alert detection timestamp
        status:
          type: string
          description: Alert status
          example: In Incident
        sourceUrl:
          type: string
          format: uri
          description: A URI of this alert pointing to the source system
          example: 'https://192.168.41.164/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=296'
        company:
          type: string
          description: The company with which the alert is associated
          example: ACME Europe
        useCase:
          type: string
          description: Alert use case
          example: UC216 - EPP - Persistent Malware
        tags:
          $ref: '#/components/schemas/Tags'
        classification:
          type: string
          description: Classification category that the alert falls into.
          example: Authentication
        observableTags:
          type: array
          uniqueItems: true
          description: List of tags of alert observables
          example:
            - Cloud-Computing
            - Virus
            - Phishing
          items:
            type: string
            pattern: ^\S*$
        categories:
          $ref: '#/components/schemas/Categories'
        detectionRule:
          type: string
          description: Name of detection rule from SIEM that triggered the generation of alert
          example: WRONG_PASSWORD_3_ATTEMPTS
        killChain:
          $ref: '#/components/schemas/KillChain'
        mitreAttacks:
          $ref: '#/components/schemas/MitreAttacks'
        alertType:
          type: string
          description: 'The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.'
          example: CTI-Landscape
          enum:
            - CTI-Landscape
            - CTI-Assetbased
            - General
        threatType:
          type: string
          description: The threat type with which this alert is associated.
          example: Phishing
    BaseIncidentSummary:
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this incident'
        key:
          type: string
          description: 'A unique, human-oriented key identifying this incident'
          example: CDC-20191208-00046
        name:
          type: string
          description: The name of the incident. Included only if the client specified it explicitly in the "include" parameter
          example: Web Proxy - Execution file download
        description:
          type: string
          description: The incident description. Included only if the client specified it explicitly in the "include" parameter
          example: |
            Customer Name - ACME Inc<br>Alert Name - Web Proxy - Execution file download<br>Device Product - Web Gateway<br>Category Outcome - /Failure<br>
        created:
          type: string
          description: The time when the incident was created
          format: date-time
        updated:
          type: string
          description: The time when the incident was last updated
          format: date-time
        type:
          type: string
          description: Incident type
          example: DDOS
        status:
          type: string
          description: The status of the incident
          example: Closed
        priority:
          type: string
          description: The priority of the incident
          example: Low
        group:
          type: string
          description: The group to which this incident is currently assigned
          example: L1
        externalIds:
          $ref: '#/components/schemas/ExternalIds'
        tags:
          $ref: '#/components/schemas/Tags'
        company:
          type: string
          description: The company with which this incident is associated
          example: ACME Europe
        pendingForGroup:
          type: string
          description: If this incident was redirected to a different group this will contain the name of the target group
        redirectionReason:
          type: string
          description: If this incident was redirected to a different group this will contain the user comment provided with redirection request
        endSlaDate:
          type: string
          format: date-time
          nullable: true
          description: Service level agreement end date
          example: '2019-08-23T14:15:22Z'
    BaseObservableSummary:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of this observable
          example: 5e13b88122c957000787db06
        type:
          description: The type of the observable
          type: string
          example: IPv4 Address
        isIoc:
          description: is this observable an indicator of compromise?
          type: boolean
          example: false
        value:
          description: The value of the observable
          type: string
          example: 192.168.40.45
        created:
          type: string
          description: The time when the observable was created
          format: date-time
        updated:
          type: string
          description: 'The time when the observable was last updated, including changes to the observable and association to incidents.'
          format: date-time
        suspiciousRate:
          type: number
          nullable: true
          description: |
            The suspicious rate of the observable (higher is more suspicious), between 0 and 100
            This field is Nullable.
            Null value meaning: Not enough data to calculate suspiciousRate, could be updated later.
          format: double
          example: 3.2
        tags:
          type: array
          description: The tags associated with this observable
          example:
            - Critical-Infrastructure
          items:
            type: string
            pattern: ^\S*$
        enrichments:
          type: array
          description: The recent and valid enrichments associated with this observable
          items:
            $ref: '#/components/schemas/EnrichmentSummary'
    BaseMessageSummary:
      type: object
      properties:
        id:
          type: string
          description: ID of the message as saved in the system
          example: 616ea579f2631c8d4c68a1b7
        externalId:
          type: string
          description: 'The identifier of the message, as it appears in external systems. Only one message can be linked to each unique externalId.'
          example: 111e3cf9-da0e-46a1-b099-3fd2e653ecbd
        scope:
          $ref: '#/components/schemas/EntityScope'
        parentMessageId:
          type: string
          description: 'If present, this message was posted in another message''s thread'
          example: 616ea579f2631c8d4c68a1b7
        attachmentIds:
          type: array
          description: IDs of file attached to this message
          example:
            - 616ea579f2631c8d4c68a1b7
          items:
            type: string
        content:
          description: The content of the message
          oneOf:
            - $ref: '#/components/schemas/TextMessageContent'
            - $ref: '#/components/schemas/AdaptiveCardMessageContent'
    AutocompleteSearchResponse:
      type: object
      properties:
        limit:
          type: number
          example: 10
        items:
          type: array
          items:
            type: string
    CustomFieldSchemaResponse:
      type: object
      properties:
        id:
          type: string
          description: The db`s document identifier
        label:
          type: string
          description: The display name of the field i.e `Some label`
        fieldName:
          type: string
          description: The internal field name i.e `incident_some_label_rich_text`
        entityType:
          description: Enum values for the type of entity i.e `INCIDENT`
          $ref: '#/components/schemas/EntityTypes'
        classifications:
          description: 'List of classifications i.e `DDOS, MALWARE` This field is mandatory if entityType is ALERT'
          type: array
          items:
            type: string
        type:
          description: 'Enum values for the available data types i.e `TEXT, RICH_TEXT, NUMBER`'
          $ref: '#/components/schemas/CustomFieldsSchemaTypesEnum'
        scope:
          description: 'Enum values for the available scopes i.e `SUMMARY, ADDITIONAL_INFO`'
          $ref: '#/components/schemas/EntityScopes'
        order:
          type: number
          description: This field controls the order of appearance. has an effect if entityType is INCIDENT
        visible:
          type: boolean
          description: This field controls the visibility for UI consumers.
        deleted:
          type: boolean
        createdAt:
          format: date-time
          type: string
        updatedAt:
          format: date-time
          type: string
      required:
        - id
        - label
        - fieldName
        - entityType
        - classifications
        - type
        - scope
        - createdAt
        - updatedAt
    QueryCustomFieldSchemaResponse:
      type: object
      properties:
        total:
          type: number
          description: The total documents available for the query. (usage for pagination)
        results:
          type: array
          items:
            $ref: '#/components/schemas/CustomFieldSchemaResponse'
        nextMarker:
          type: string
      required:
        - total
        - results
        - nextMarker
    QueryCustomFieldResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/CustomField'
        nextMarker:
          type: string
        total:
          type: number
      required:
        - results
        - nextMarker
        - total
    CustomField:
      type: object
      properties:
        id:
          type: string
        entityId:
          type: string
        entityType:
          enum:
            - ALERT
            - INCIDENT
          type: string
        name:
          type: string
        value:
          type: object
        createdAt:
          type: string
        updatedAt:
          type: string
        createdBy:
          type: string
        updatedBy:
          type: string
      required:
        - id
        - entityId
        - entityType
        - name
        - value
        - createdAt
        - updatedAt
    CreateManyCustomFieldRequest:
      type: object
      properties:
        request:
          type: array
          items:
            $ref: '#/components/schemas/CreateCustomFieldRequest'
      required:
        - request
    CreateCustomFieldRequest:
      type: object
      properties:
        entityId:
          type: string
        entityType:
          enum:
            - ALERT
            - INCIDENT
          type: string
        name:
          type: string
        value:
          type: object
      required:
        - entityId
        - name
        - value
    CreateCustomFieldResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/CustomField'
      required:
        - results
    CustomFieldsSchemaTypesEnum:
      type: string
      enum:
        - TEXT
        - RICH_TEXT
        - EMAIL
        - NUMBER
        - IPV4
        - IPV6
        - DATETIME
        - TEXT_LIST
        - BOOLEAN_RADIO
    EntityScopes:
      type: string
      enum:
        - ADDITIONAL_INFO
        - SUMMARY
    EntityTypes:
      type: string
      enum:
        - ALERT
        - INCIDENT
    AlertExtendedPropertiesResponse:
      type: object
      properties:
        name:
          type: string
          description: The internal field name of the custom-field schema
        value:
          type: object
          description: 'The actual field`s value, can be any data type or nullable'
        id:
          type: string
          description: The db`s document identifier
        createdBy:
          type: string
          description: The user who created the resource
        updatedBy:
          type: string
          description: The user who updated the resource
        createdAt:
          type: string
        updatedAt:
          type: string
      required:
        - name
        - id
        - createdBy
        - updatedBy
        - createdAt
        - updatedAt
    AlertSummary:
      required:
        - id
        - source
        - sourceId
        - name
        - description
        - severity
        - status
        - created
        - modified
        - detected
        - categories
        - tags
        - observableTags
        - killChain
        - alertType
      type: object
      properties:
        id:
          type: string
          description: 'A unique, machine-oriented ID identifying this alert.'
          example: 5e7c6cf54b832e0018f191ad
        source:
          type: string
          description: The name of the source system
          example: QRadar
        sourceId:
          type: string
          description: The ID of the alert in the source system
          example: 296
        score:
          type: number
          nullable: true
          description: |
            The score of the alert
            This field is Nullable.
            Null value meaning: Not enough data to calculate score, could be updated later.
          format: double
          example: 33.2
        name:
          type: string
          description: The name of the alert
          example: Windows - Multiple failed logins same user same host
        description:
          type: string
          description: The description of the alert
          example: |
            Customer Name - AcmeCo
            Alert Name - Windows - Multiple failed logins same user same host
            Device Vendor - Microsoft
            Device Product - Microsoft Windows
            Device Event Class Id - rule:105
        severity:
          type: string
          description: The severity of the alert
          example: Medium
        created:
          type: string
          format: date-time
          description: Alert creation timestamp
        modified:
          type: string
          format: date-time
          description: Last modification timestamp
        detected:
          type: string
          format: date-time
          description: Alert detection timestamp
        status:
          type: string
          description: Alert status
          example: In Incident
        sourceUrl:
          type: string
          format: uri
          description: A URI of this alert pointing to the source system
          example: 'https://192.168.41.164/console/do/sem/offensesummary?appName=Sem&pageId=OffenseSummary&summaryId=296'
        company:
          type: string
          description: The company with which the alert is associated
          example: ACME Europe
        useCase:
          type: string
          description: Alert use case
          example: UC216 - EPP - Persistent Malware
        tags:
          $ref: '#/components/schemas/Tags'
        classification:
          type: string
          description: Classification category that the alert falls into.
          example: Authentication
        observableTags:
          type: array
          uniqueItems: true
          description: List of tags of alert observables
          example:
            - Cloud-Computing
            - Virus
            - Phishing
          items:
            type: string
            pattern: ^\S*$
        categories:
          $ref: '#/components/schemas/Categories'
        detectionRule:
          type: string
          description: Name of detection rule from SIEM that triggered the generation of alert
          example: WRONG_PASSWORD_3_ATTEMPTS
        killChain:
          $ref: '#/components/schemas/KillChain'
        mitreAttacks:
          $ref: '#/components/schemas/MitreAttacks'
        alertType:
          type: string
          description: 'The type of the alert. Must be one of the alert types defined in CDC - see Enumerated values. When not provided or invalid value, alertType will be set to General.'
          example: CTI-Landscape
          enum:
            - CTI-Landscape
            - CTI-Assetbased
            - General
        threatType:
          type: string
          description: The threat type with which this alert is associated.
          example: Phishing
    CreateAlertExtendedPropertiesRequest:
      type: object
      properties:
        name:
          type: string
          description: The internal field name of the custom-field schema
        value:
          type: object
          description: 'The actual field`s value, can be any data type or nullable'
      required:
        - name
    CreateAlertExtendedPropertiesResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/AlertExtendedPropertiesResponse'
      required:
        - results
    CreateAlertsExtendedPropertiesRequest:
      type: object
      properties:
        request:
          type: array
          items:
            $ref: '#/components/schemas/CreateAlertExtendedPropertiesRequest'
      required:
        - request
    CreateIncidentsSummaryRequest:
      type: object
      properties:
        request:
          type: array
          items:
            $ref: '#/components/schemas/CreateIncidentSummaryRequest'
      required:
        - request
    CreateIncidentSummaryRequest:
      type: object
      properties:
        name:
          type: string
          description: The internal field name of the custom-field schema
        value:
          type: object
          description: 'The actual field`s value, can be any data type or nullable'
      required:
        - name
    CreateIncidentSummaryResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/IncidentSummaryResponse'
      required:
        - results
    IncidentSummaryResponse:
      type: object
      properties:
        name:
          type: string
          description: The internal field name of the custom-field schema
        value:
          type: object
          description: 'The actual field`s value, can be any data type or nullable'
        id:
          type: string
          description: The db`s document identifier
        createdBy:
          type: string
          description: The user who created the resource
        updatedBy:
          type: string
          description: The user who updated the resource
        createdAt:
          type: string
        updatedAt:
          type: string
      required:
        - name
        - id
        - createdBy
        - updatedBy
        - createdAt
        - updatedAt
    QueryAlertExtendedPropertiesResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/AlertExtendedPropertiesResponse'
        nextMarker:
          type: string
      required:
        - results
    QueryIncidentSummaryResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/IncidentSummaryResponse'
        nextMarker:
          type: string
      required:
        - results
  parameters:
    incidentId:
      in: path
      name: incidentId
      description: The unique ID of the incident
      example: 5a9e19eebdee5a000a8fe060
      required: true
      schema:
        type: string
    alertId:
      in: path
      name: alertId
      description: 'The unique ID of the alert, as defined by CDC'
      example: 5a9e19eebdee5a000a8fe060
      required: true
      schema:
        type: string
    fileId:
      in: path
      name: fileId
      required: true
      description: 'A unique, machine-oriented ID identifying this file.'
      schema:
        type: string
        example: 5e7c6cf54b832e0018f191ad
    observableType:
      in: query
      name: observableType
      description: The type of the observable
      example: IPv4 Address
      deprecated: false
      required: true
      schema:
        type: string
    observableValue:
      in: query
      name: observableValue
      description: The value of the observable
      example: 192.168.40.45
      deprecated: false
      required: true
      schema:
        type: string
    apiKey:
      in: query
      name: apiKey
      description: API key
      schema:
        type: string
      example: 30c050f7fdfe466b9442570ae77dbc8a
    marker:
      in: query
      name: marker
      description: 'A continuation token, used to retrieve the next results page.'
      schema:
        type: string
        format: byte
    createdBy:
      in: query
      name: createdBy
      description: Include only those which were created by a specific user ID
      schema:
        type: string
    createdAfter:
      in: query
      name: createdAfter
      description: Include only those which were created after or at the specified timestamp (inclusive)
      schema:
        type: string
        format: date-time
    createdBefore:
      in: query
      name: createdBefore
      description: Include only those which were created before the specified timestamp (exclusive)
      schema:
        type: string
        format: date-time
    updatedAfter:
      in: query
      name: updatedAfter
      description: Include only those which were updated after or at the specified timestamp (inclusive)
      schema:
        type: string
        format: date-time
    updatedBefore:
      in: query
      name: updatedBefore
      description: Include only those which were updated before the specified timestamp (exclusive)
      schema:
        type: string
        format: date-time
    externalId:
      in: query
      name: externalId
      description: |
        Filters according to the specified external ID. Used in conjuction with the externalSystem parameter. 
        If specified, then `externalSystem` MUST be specified as well. 
      schema:
        type: string
    externalSystem:
      in: query
      name: externalSystem
      description: |
        Identifies the external system to which the filter refers. 
        Used in conjuction with the externalId parameter:
        - If `externalId` is also specified, the filter will return only items which have the specified `externalId` at the specified `externalSystem`.
        - If `externalId` is not specified, the filter will return all items which have some external ID at the specified `externalSystem`
      schema:
        type: string
    scopeType:
      in: query
      name: scopeType
      description: The type of the entity ( alert / incident / channel ...)
      example: alert
      required: true
      schema:
        type: string
        enum:
          - alert
          - incident
          - channel
    fileScopeType:
      in: query
      name: scopeType
      description: The type of the entity ( alert / incident / channel / visualization...)
      example: alert
      required: true
      schema:
        type: string
        enum:
          - alert
          - incident
          - channel
          - visualization
    If-Match:
      in: header
      name: If-Match
      schema:
        type: string
      description: 'Enables conditional modification - the resource will be modified only if its current etag matches the value specified in this header, otherwise - 412 "Precondition Failed" will be returned to the client'
    X-API-KEY:
      in: header
      name: X-API-KEY
      schema:
        type: string
      description: API key
      example: 30c050f7fdfe466b9442570ae77dbc8a
    Authorization:
      in: header
      name: Authorization
      schema:
        type: string
      required: true
      description: JWT token
      example: Bearer 234jksjfsDFSDFw342wkmsdflksfmjsdf342XFf
  responses:
    NotModified:
      description: The resource was found and has not been modified (with regards to the If-None-Match header provided by the client)
    BadRequest:
      description: The request is invalid
    Unauthorized:
      description: Authentication failure
    Forbidden:
      description: The client does not have sufficient priviliges to access the requested resource or perform the requested operation
    NotFound:
      description: The requested resource was not found
    Conflict:
      description: The request conflicts with the current state of the resource.
    PreconditionFailed:
      description: 'A precondition specified by the client was not met. This occurs if an etag was specified in an If-Match header, which doesn''t match the etag found in the underlying data store'
    TooManyRequests:
      description: 'Too many requests (throttled). The client should backoff and retry later on, in accordance to the rate limiting policy of the server.'
    BadGateway:
      description: 'The API server, acting as a gateway, got an invalid response from the underlying data store'
    ServiceUnavailable:
      description: The server cannot handle the request at the moment
    GatewayTimeout:
      description: 'The API server, acting as a gateway, could not get a response from the underlying data store in due time'
    PayloadTooLarge:
      description: The payload sent by the client exceeds the size limits imposed by the server
    InternalServerError:
      description: The server encountered an unexpected condition that prevented it from fulfilling the request
    Gone:
      description: The resource requested is no longer available and will not be available again. The resource could have been intentionally removed and should be purged. The client should not request the resource in the future.
    UnprocessableEntity:
      description: 'The server understands the content type of the request entity, and the syntax of the request entity is correct, but it was unable to process the contained instructions. The client should not repeat this request without modification.'
  securitySchemes:
    ApiKeyHeader:
      type: apiKey
      in: header
      name: X-API-KEY
    ApiKeyQuery:
      type: apiKey
      in: query
      name: apiKey
security:
  - ApiKeyHeader: []
  - ApiKeyQuery: []
paths:
  /alerts:
    post:
      operationId: createAlert
      summary: Creates a new alert
      description: |
        Creates a new alert in CDC.<br/>
        This operation is idempotent: if the client provides a sourceId which already exists in CDC, then the operation should succeed with UPSERT semantics.br/>
        **NOTE:** The maximum request size is 2 MB.
      tags:
        - alerts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAlertRequest'
      responses:
        '201':
          description: The alert has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    get:
      operationId: queryAlerts
      summary: |
        Queries alerts based on filters provided by the client.
        For synchronization purposes, the `updatedAfter` filter option should be used.
      tags:
        - alerts
      parameters:
        - $ref: '#/components/parameters/marker'
        - $ref: '#/components/parameters/updatedBefore'
        - $ref: '#/components/parameters/updatedAfter'
        - in: query
          name: detectedBefore
          description: Include only those which were detected before the specified timestamp (exclusive)
          schema:
            type: string
            format: date-time
        - in: query
          name: detectedAfter
          description: Include only those which were detected after the specified timestamp (inclusive)
          schema:
            type: string
            format: date-time
        - in: query
          name: status
          description: Filter alerts by status
          schema:
            type: array
            items:
              type: string
        - in: query
          name: severity
          description: Filter alerts by severity
          schema:
            type: array
            items:
              type: string
          example: Medium
        - in: query
          name: company
          description: Filter alerts by company
          schema:
            type: string
          example: ACME Europe
        - in: query
          name: source
          schema:
            type: string
          example: arcsight
          description: |
            Filters alerts by their source system.
            Often combined with the `sourceId` parameter, in order to find an alert by its external ID.`
        - in: query
          name: sourceId
          schema:
            type: string
          example: 1234
          description: |
            When combined with the `source` parameter - finds an alert by its source ID (the ID as defined by the SIEM).
            If `sourceId` is specified but `source` is not specified, the query will fail and return 400 (Bad Request). 
        - in: query
          name: useCase
          schema:
            type: string
          example: arcsight
          description: Filters alerts by their use case.
        - in: query
          name: observableType
          description: |
            Filters alerts by observable: only alerts linked to the specified observable will be returned. 

            This parameter specifies the observable's type, and it must be combined with the `observableValue` parameter.
          schema:
            type: string
          example: IPv4 Address
        - in: query
          name: observableValue
          schema:
            type: string
          description: |
            Filters alerts by observable: only alerts linked to the specified observable will be returned. 

            This parameter specifies the observable's value, and it must be combined with the `observableType` parameter.
          example: 192.168.40.45
        - in: query
          name: alertType
          description: Filter alerts by their type
          example:
            - CTI-Landscape
          schema:
            type: array
            items:
              type: string
              enum:
                - General
                - CTI-Assetbased
                - CTI-Landscape
        - in: query
          name: threatType
          description: Filter alerts by threat types
          example:
            - Phishing
            - Malware
          schema:
            type: array
            items:
              type: string
        - in: query
          name: tags
          schema:
            type: array
            items:
              type: string
            maxItems: 5
          description: |
            Filters alerts by tags.

            Note: if more than one tag is specified, the client must specify the `tagsCondition` (otherwise: the server will return 400 Bad Request)
          example:
            - Phishing
            - Email
        - in: query
          name: tagsCondition
          description: |
            If `tags` contains multiple items, determines the query predicate:
            - `any`: returns results which contain at least one of the specified tags
            - `all`: returns results which contain all of the specified tags
          schema:
            type: string
            enum:
              - any
              - all
        - in: query
          name: observableTags
          schema:
            type: array
            items:
              type: string
            maxItems: 5
          description: |
            Filters alerts by observable tags.

            Note: if more than one tag is specified, the client must specify the `observableTagsCondition` (otherwise: the server will return 400 Bad Request)
          example:
            - Phishing
            - Email
        - in: query
          name: observableTagsCondition
          description: |
            If `observableTags` contains multiple items, determines the query predicate:
            - `any`: returns results which contain at least one of the specified tags
            - `all`: returns results which contain all of the specified tags
          schema:
            type: string
            enum:
              - any
              - all
        - in: query
          name: threatActors
          description: |
            Filters alerts by threat actors.
            Note: if more than one value is specified, the client must specify the `threatActorsCondition` (otherwise: the server will return 400 Bad Request)
          example:
            - actor1
            - actor2
          schema:
            type: array
            maxItems: 5
            items:
              type: string
              maxLength: 200
        - in: query
          name: threatActorsCondition
          description: |
            If `threatActors` contains multiple items, determines the query predicate:
            - `any`: returns results which contain at least one of the specified values
            - `all`: returns results which contain all of the specified values
          schema:
            type: string
            enum:
              - any
              - all
        - in: query
          name: malwareTools
          description: |
            Filters alerts by maleware and tools.
            Note: if more than one value is specified, the client must specify the `malwareToolsCondition` (otherwise: the server will return 400 Bad Request)
          example:
            - Cobalt Strike
            - DarkSide
          schema:
            type: array
            maxItems: 5
            items:
              type: string
              maxLength: 200
        - in: query
          name: malwareToolsCondition
          description: |
            If `malwareTools` contains multiple items, determines the query predicate:
            - `any`: returns results which contain at least one of the specified values
            - `all`: returns results which contain all of the specified values
          schema:
            type: string
            enum:
              - any
              - all
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/alerts/{alertId}':
    get:
      operationId: getAlert
      summary: Returns a single alert
      tags:
        - alerts
      parameters:
        - $ref: '#/components/parameters/alertId'
      responses:
        '200':
          description: success
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/alerts/{alertId}/evidence':
    get:
      operationId: queryAlertEvidence
      summary: Returns information about the evidence associated with this alert.
      tags:
        - alerts
        - evidence
      parameters:
        - $ref: '#/components/parameters/alertId'
        - $ref: '#/components/parameters/marker'
        - in: query
          name: include
          description: |
            Specifies which additional fields to include in the query results:
            - `data`: includes the evidence metadata.
          schema:
            type: array
            items:
              type: string
              enum:
                - data
          style: form
          explode: false
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvidenceQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    post:
      operationId: createAlertEvidence
      summary: Creates a new alert evidence
      tags:
        - alerts
        - evidence
      parameters:
        - $ref: '#/components/parameters/alertId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEvidenceRequest'
      responses:
        '201':
          description: The evidence has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Evidence'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/alerts/{alertId}/extended-properties':
    get:
      operationId: getExtendedProperties
      summary: Query alert extended properties
      description: with support for filters and pagination. Default limit is 1000 docs per request.
      parameters:
        - name: alertId
          required: true
          in: path
          schema:
            type: string
        - name: names
          required: false
          in: query
          description: List of the internal field name of the custom-field schema
          schema:
            type: array
            items:
              type: string
        - name: ids
          required: false
          in: query
          description: List of the db`s document identifier
          schema:
            type: array
            items:
              type: string
        - name: marker
          required: false
          in: query
          schema:
            type: string
      responses:
        '200':
          description: Response for query alert extended properties
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryAlertExtendedPropertiesResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
      tags:
        - alert-extended-properties
    post:
      operationId: setExtendedProperties
      summary: Set alert extended properties
      description: Set alert extended properties
      parameters:
        - name: alertId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAlertsExtendedPropertiesRequest'
      responses:
        '200':
          description: Response for create alert extended properties
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateAlertExtendedPropertiesResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
      tags:
        - alert-extended-properties
  /incidents:
    get:
      operationId: queryIncidents
      summary: |
        Queries incidents based on filters provided by the client.
        For synchronization purposes, the `updatedAfter` filter option should be used.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/marker'
        - $ref: '#/components/parameters/externalId'
        - $ref: '#/components/parameters/externalSystem'
        - in: query
          name: include
          description: |
            Specifies which additional fields to include in the query results:
            - `name`: includes the incident name.
            - `description`: includes the incident description.
            - `tags`: includes the incident tags.
            - `externalIds`: includes the external IDs associated with the incident, which the caller has permission to access.
            - `company`: includes the company associated with the incident.
          schema:
            type: array
            items:
              type: string
              enum:
                - name
                - description
                - tags
                - externalIds
                - company
                - redirectionReason
          style: form
          explode: false
        - in: query
          name: status
          description: Filter incidents by status
          schema:
            type: array
            items:
              type: string
          style: form
          explode: false
        - in: query
          name: pendingForGroup
          description: Return only incidents that are pending redirection to the specified group.
          schema:
            type: string
        - in: query
          name: group
          description: 'filter incidents by the group (tier) which currently owns them (L1, L2, Customer)'
          schema:
            type: string
        - $ref: '#/components/parameters/updatedBefore'
        - $ref: '#/components/parameters/updatedAfter'
        - in: query
          name: observableType
          description: |
            Filters incidents by observable: only incidents linked to the specified observable will be returned. 
            This parameter specifies the observable's type, and it must be combined with the `observableValue` parameter. 
          schema:
            type: string
          example: IPv4 Address
        - in: query
          name: observableValue
          schema:
            type: string
          description: |
            Filters incidents by observable: only incidents linked to the specified observable will be returned. 
            This parameter specifies the observable's value, and it must be combined with the `observableType` parameter. 
          example: 192.168.40.45
        - in: query
          name: tags
          schema:
            type: array
            items:
              type: string
              pattern: ^\S*$
            maxItems: 5
          description: |
            Filters incidents by tags.

            Note: if more than one tag is specified, the client must specify the `tagsCondition` (otherwise: the server will return 400 Bad Request)
          example:
            - Phishing
            - Email
        - in: query
          name: tagsCondition
          description: |
            If `tags` contains multiple items, determines the query predicate:
            - `any`: returns results which contain at least one of the specified tags
            - `all`: returns results which contain all of the specified tags
          schema:
            type: string
            enum:
              - any
              - all
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}':
    get:
      operationId: getIncident
      summary: Returns a single incident
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
      responses:
        '200':
          description: success
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Incident'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    patch:
      operationId: updateIncident
      summary: Updates an incident
      description: |
        A JSON object with details of the incident.<br/>
        **NOTE:** The maximum request size is 100 KB.<br/>
        **NOTE:** If `tags` is included, existing incident's tags are replaced with the specified ones.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/If-Match'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateIncidentRequest'
      responses:
        '200':
          description: The incident was updated
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Incident'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: The attempted operation conflicts with the current state of the incident
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/messages':
    post:
      operationId: createIncidentMessage
      summary: Creates a new incident message
      description: |
        Creates a new incident message in CDC.<br/>
        This operation is idempotent: if the client provides an external id which already exists in CDC, then the operation should succeed with UPSERT semantics.<br/>
        **NOTE:** The maximum request size is 512 KB.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIncidentMessageRequest'
      responses:
        '201':
          description: The message has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentMessageSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/close':
    post:
      operationId: closeIncident
      summary: Closes an incident
      description: A JSON object with details of the incident
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/If-Match'
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloseIncidentRequest'
            example:
              closingComment: 'This incident has been investigated and was deemed to be a false alarm - the user had their CAPSLOCK on, which is why they entered the wrong password'
      responses:
        '204':
          description: The incident was closed successfully
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: The attempted operation conflicts with the current state of the incident
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/redirect':
    post:
      operationId: redirectIncident
      summary: initiate a redirection
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/If-Match'
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RedirectIncidentRequest'
      responses:
        '204':
          description: The redirection has been issued
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: The specified incident was not found
        '409':
          description: The attempted operation conflicts with the current state of the incident
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/accept':
    post:
      operationId: acceptIncidentRedirection
      summary: accepts a redirection request
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/If-Match'
        - $ref: '#/components/parameters/incidentId'
      responses:
        '204':
          description: The redirection has been successfully accepted
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          description: The specified incident was not found
        '409':
          description: There currently isn't any pending redirection for this incident
        '412':
          $ref: '#/components/responses/PreconditionFailed'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/alerts':
    get:
      operationId: queryIncidentAlerts
      summary: Returns information about the alerts associated with this incident.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/marker'
        - in: query
          name: include
          description: |
            Specifies which additional fields to include in the query results:
            - `raw`: includes the raw alert data.
            - `company`: includes the company field.
          schema:
            type: array
            items:
              type: string
              enum:
                - raw
                - company
          style: form
          explode: false
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAlertsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/alert-ids':
    get:
      operationId: queryIncidentAlertIds
      summary: Returns the IDs of the alerts associated with this incident.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/marker'
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAlertIdsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/observables':
    get:
      operationId: queryIncidentObservables
      summary: Returns information about the observables associated with this incident.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/marker'
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentObservablesQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    post:
      operationId: createIncidentObservable
      summary: Creates a new incident observable
      description: |
        Creates a new incident observable in CDC<br />
        This operation is idempotent: if the client provides a type and value which already exist in CDC, then the operation should succeed with UPSERT semantics.<br/>
        **NOTE:** The maximum request size is 100 KB.
      tags:
        - incidents
      parameters:
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIncidentObservableRequest'
      responses:
        '201':
          description: The observable has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObservableSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/evidence':
    get:
      operationId: queryIncidentEvidence
      summary: Returns information about the evidence associated with this incident.
      tags:
        - incidents
        - evidence
      parameters:
        - $ref: '#/components/parameters/incidentId'
        - $ref: '#/components/parameters/marker'
        - in: query
          name: include
          description: |
            Specifies which additional fields to include in the query results:
            - `data`: includes the evidence metadata.
          schema:
            type: array
            items:
              type: string
              enum:
                - data
          style: form
          explode: false
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EvidenceQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    post:
      operationId: createIncidentEvidence
      summary: Creates a new incident evidence
      tags:
        - incidents
        - evidence
      parameters:
        - $ref: '#/components/parameters/incidentId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateEvidenceRequest'
      responses:
        '201':
          description: The evidence has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Evidence'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/incidents/{incidentId}/summary':
    get:
      operationId: getIncidentSummary
      summary: Query incident summary
      description: Query incident summary with support for filters and pagination. Default limit is 1000 docs per request.
      parameters:
        - name: incidentId
          required: true
          in: path
          schema:
            type: string
        - name: names
          required: false
          in: query
          description: List of the internal field name of the custom-field schema
          schema:
            type: array
            items:
              type: string
        - name: ids
          required: false
          in: query
          description: List of the db`s document identifier
          schema:
            type: array
            items:
              type: string
        - name: marker
          required: false
          in: query
          schema:
            type: string
      responses:
        '200':
          description: Response for query incident summary public
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryIncidentSummaryResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
      tags:
        - incident-summary
    post:
      operationId: setIncidentSummary
      summary: Set incident summary
      description: Set incident summary
      parameters:
        - name: incidentId
          required: true
          in: path
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIncidentsSummaryRequest'
      responses:
        '200':
          description: Response for Create incident summary
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateIncidentSummaryResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
      tags:
        - incident-summary
  /observables:
    get:
      operationId: getObservable
      summary: |
        Gets the specified observable based on its type and value.
      tags:
        - observables
      parameters:
        - $ref: '#/components/parameters/observableType'
        - in: query
          name: observable_type
          description: |
            The type of the observable.
            **Deprecated**: please use `observableType` instead of `observable_type`
          example: IPv4 Address
          deprecated: true
          required: false
          schema:
            type: string
        - $ref: '#/components/parameters/observableValue'
        - in: query
          name: observable_value
          description: |
            The value of the observable.
            **Deprecated**: please use `observableValue` instead of `observable_value`
          example: 192.168.40.45
          deprecated: true
          required: false
          schema:
            type: string
      responses:
        '200':
          description: A JSON object containing the observable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObservableSummary'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /observables/alert-ids:
    get:
      operationId: queryObservableAlertIds
      summary: |
        Queries alert IDs associated with the observable.
      tags:
        - observables
        - alerts
      parameters:
        - $ref: '#/components/parameters/observableType'
        - $ref: '#/paths/~1observables/get/parameters/1'
        - $ref: '#/components/parameters/observableValue'
        - $ref: '#/paths/~1observables/get/parameters/3'
        - $ref: '#/components/parameters/marker'
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObservableAlertIdsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /observables/incident-ids:
    get:
      operationId: queryObservableIncidentIds
      summary: |
        Queries incident IDs associated with the observable.
      tags:
        - observables
        - incidents
      parameters:
        - $ref: '#/components/parameters/observableType'
        - $ref: '#/paths/~1observables/get/parameters/1'
        - $ref: '#/components/parameters/observableValue'
        - $ref: '#/paths/~1observables/get/parameters/3'
        - $ref: '#/components/parameters/marker'
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ObservableIncidentIdsQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /messages:
    post:
      operationId: createMessage
      summary: Create a new message
      tags:
        - messages
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MessageCreateRequest'
      responses:
        '201':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Message'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
    get:
      operationId: queryMessages
      summary: |
        Queries messages based on filters provided by the client.
        For synchronization purposes, the `updatedAfter` filter option should be used.
      tags:
        - messages
      parameters:
        - $ref: '#/components/parameters/marker'
        - $ref: '#/components/parameters/scopeType'
        - in: query
          name: scopeId
          description: filter by id of the entity as saved in the system must be supplied with scopeType.
          schema:
            type: string
        - in: query
          name: fileNames
          description: filter by messages that include a file by this name as attachment note- if "fileIds" is supplied this field is ignored
          schema:
            type: array
            items:
              type: string
          style: form
          explode: true
        - in: query
          name: fileIds
          description: filter by files that include a file by this id as attachment note- this takes precedent over "fileNames"
          schema:
            type: array
            items:
              type: string
          style: form
          explode: true
        - in: query
          name: hasAttachments
          description: filter by either with or wihtout attachments
          schema:
            type: boolean
        - $ref: '#/components/parameters/createdBy'
        - $ref: '#/components/parameters/createdBefore'
        - $ref: '#/components/parameters/createdAfter'
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MessagesQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /search:
    post:
      operationId: search
      summary: Returns result of Search QL
      tags:
        - search
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - query
              properties:
                query:
                  description: |
                    CDC Query string

                    Full query syntax can be derived from CDC Query Language docs
                  example: select from alert where status = 'New'
                  type: string
                include:
                  description: |
                    List of fields from query subject collection to be populated.

                    List of supported fields should be taken from CDC Query Language docs for the appropriate collection. (If some fields are filtered by PAPI but used as include value, they still will not be returned in response)
                  example: 'name,status,severity,description'
                  type: string
                  format: comma-separated-list
                limit:
                  description: 'Amount of records to return in query result. (If field is omitted, default value of 20 is used)'
                  example: 10
                  default: 20
                  type: integer
                skip:
                  description: Amount of records to skip in query result
                  example: 0
                  default: 0
                  type: integer
                sort:
                  type: string
                  description: |
                    Sort order for query results to be sorted, if value not provided defaults to `created`:
                      * `Alert` - when you query for alerts, you should sort by (:asc/desc possible): >
                        * `created` - created date, used by default
                        * `name`
                        * `severity.order`
                        * `status.order` 
                        * `detected`
                        * `ownerRef.displayName`
                        * `source`
                        * `company`
                        * `score.value` - this is database relevance score
                      * `Incident` - when you query for incidents, you should sort by (:asc/desc possible): >
                        * `created`
                        * `modified`
                        * `name`
                        * `group`
                        * `company`
                        * `key`
                        * `priority.order`
                        * `status.value`
                        * `ownerRef.displayName`
                        * `key`
                        * `transition.targetGroup`
                      * `Observable` - when you query for observables, you should sort by (:asc/desc possible): >
                        * `created`
                        * `modified`
                        * `type`
                        * `value`
                        * `suspiciousRate`
                        * `tags`
                        * `relatedAlertsLength`
                        * `relatedIncidentsLength`
                        * `isIoc`
                      * `Message` - when you query for messages, you should sort by (:asc/desc possible): >
                        * `created`
                  example: created
                  enum:
                    - company
                    - 'company:asc'
                    - 'company:desc'
                    - created
                    - 'created:asc'
                    - 'created:desc'
                    - detected
                    - 'detected:asc'
                    - 'detected:desc'
                    - group
                    - 'group:asc'
                    - 'group:desc'
                    - isIoc
                    - 'isIoc:asc'
                    - 'isIoc:desc'
                    - key
                    - 'key:asc'
                    - 'key:desc'
                    - modified
                    - 'modified:asc'
                    - 'modified:desc'
                    - name
                    - 'name:asc'
                    - 'name:desc'
                    - ownerRef.displayName
                    - 'ownerRef.displayName:asc'
                    - 'ownerRef.displayName:desc'
                    - priority.order
                    - 'priority.order:asc'
                    - 'priority.order:desc'
                    - relatedAlertsLength
                    - 'relatedAlertsLength:asc'
                    - 'relatedAlertsLength:desc'
                    - relatedIncidentsLength
                    - 'relatedIncidentsLength:asc'
                    - 'relatedIncidentsLength:desc'
                    - score.value
                    - 'score.value:asc'
                    - 'score.value:desc'
                    - severity.order
                    - 'severity.order:asc'
                    - 'severity.order:desc'
                    - source
                    - 'source:asc'
                    - 'source:desc'
                    - status.order
                    - 'status.order:asc'
                    - 'status.order:desc'
                    - status.value
                    - 'status.value:asc'
                    - 'status.value:desc'
                    - suspiciousRate
                    - 'suspiciousRate:asc'
                    - 'suspiciousRate:desc'
                    - tags
                    - 'tags:asc'
                    - 'tags:desc'
                    - transition.targetGroup
                    - 'transition.targetGroup:asc'
                    - 'transition.targetGroup:desc'
                    - type
                    - 'type:asc'
                    - 'type:desc'
                    - value
                    - 'value:asc'
                    - 'value:desc'
                includeTotal:
                  description: |
                    Should we return total count of found records

                    Lowers performance
                  example: true
                  default: false
                  type: boolean
      parameters: []
      responses:
        '200':
          description: A JSON object containing the observable
          headers:
            ETag:
              $ref: '#/components/headers/ETag'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CDCQueryResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /search/autocomplete:
    get:
      operationId: autocomplete
      summary: Returns result of autocomplete
      tags:
        - search
        - autocomplete
      parameters:
        - in: query
          name: fieldName
          example: status
          required: false
          schema:
            type: string
          description: |
            **Required** in case collection is not "**alertExtraProperties**" or "**observableExtraProperties**"
            The value of "fieldName" depends on "collection". Example collection="alert" fieldName="classification"
            - message
              - text
            - alert
              - tags
              - observableTags
              - owner
              - mitreAttacks
              - type
              - closingReason
              - name
              - description
              - source
              - sourceId
              - sourceUrl
              - detectionRule
              - killChain
              - classification
              - threatActors
              - malwareTools
              - severity
              - status
              - threatType
              - company
              - useCase
            - observable
              - tags
              - value
              - type
            - incident
              - tags
              - owner
              - users
              - mitreAttacks
              - status
              - company
              - source
              - name
              - description
              - group
              - key
              - type
              - priority
              - closingReason
        - in: query
          name: substring
          required: false
          schema:
            type: string
          example: In
        - in: query
          name: limit
          required: false
          schema:
            type: number
            default: 10
          example: 20
        - in: query
          name: collection
          required: true
          schema:
            type: string
            enum:
              - alert
              - observable
              - incident
              - alertRawData
              - alertExtraProperties
              - observableExtraProperties
              - message
          example: alert
      responses:
        '200':
          description: A JSON object containing the results
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AutocompleteSearchResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /files/upload:
    post:
      operationId: uploadFile
      summary: Upload a new file
      description: |
        Securely upload a new file to CDC.

        Maximum file size = 12 Mb (12,582,912 bytes)
      tags:
        - files
      parameters:
        - name: scopeId
          required: true
          in: query
          description: |
            A unique, machine-oriented ID identifying this scope. must be provided together with scopeType. e.g. if scopeType = alert, then scopeId = [the alert ID]
          schema:
            type: string
            example: 5e7c6cf54b832e0018f191ad
        - $ref: '#/components/parameters/fileScopeType'
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/UploadFileRequest'
      responses:
        '201':
          description: Listing information for the uploaded file
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FileInfo'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  '/files/{fileId}/download':
    get:
      operationId: downloadFile
      summary: Download a file
      description: |
        Download a file by id

        Errors: 
         - File is still uploading - Expected error code 409 (Conflict)
         - File had malicious content so it is not avaliable - Expected error code 410 (Gone)
      tags:
        - files
      parameters:
        - $ref: '#/components/parameters/fileId'
        - name: thumbnail
          description: |
            Download thumbnail image if exists
            A thumbnail is a small image representation of a larger image or a video.
          in: query
          schema:
            type: boolean
            example: false
      responses:
        '200':
          description: Binary file stream with file contents
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/DownloadFileResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '410':
          $ref: '#/components/responses/Gone'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /files:
    get:
      operationId: queryFiles
      summary: Query files
      description: |
        Query files (files metatata) by different prarms (i.e. scope, id, filenames etc...)
        Sorting and pagination supported using marker.

        - Logic between the filters : AND - i.e All conditions should be satisfied
        - Default sorting - Creation time ASC
        - Items per page: 30
      tags:
        - files
      parameters:
        - $ref: '#/components/parameters/marker'
        - in: query
          name: ids
          description: Filter files by id
          example:
            - 5a9e19eebdee5a000a8fe060
            - 1f3e19eebdee5a000a8fefe6
          schema:
            type: array
            items:
              type: string
        - in: query
          name: status
          description: Filter files by status
          example:
            - ready
            - verified
          schema:
            type: array
            items:
              type: string
        - in: query
          name: fileName
          description: |
            Filter files by fileName
            Partial filename can be provided. i.e. givven filename param = 'ample', the file 'sample.txt'
            will be found assuming it exists in the system and all other filtes apply.
          example: sample
          schema:
            type: string
        - in: query
          name: scopeType
          description: |
            Filter files by entity scope type.
            This filter is related to scopeId. i.e. if scopeType is provided then scopeId should be provided as well.
          schema:
            type: string
            enum:
              - alert
              - incident
              - channel
              - visualization
          example: alert
        - in: query
          name: scopeId
          schema:
            type: string
          example: 5a9e19eebdee5a000a8fe060
          description: |
            Filter files by Entity scope ID. 
            e.g. query files only associated with alert with ID 5a9e19eebdee5a000a8fe060.
            This filter is related to scopeType. i.e. if scopeId is provided then scopeType should be provided as well.
      responses:
        '200':
          description: A JSON object containing the results and additional information
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FilesQueryResults'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /grouping/settings:
    get:
      operationId: queryGroupingSettings
      summary: Returns grouping settings
      description: |
        **NOTE:** To access Grouping Settings, user should have specific Admin privileges.
      tags:
        - grouping
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                type: object
                properties:
                  incidentTimeLimit:
                    type: number
                    description: time limit in milliseconds. Time within which alerts could be grouped to an incident since it was created.
                    example: 86400000
                  maxAlertsPerIncident:
                    type: number
                    description: maximum number of alerts which can be attached to one incident.
                    example: 150
                required:
                  - incidentTimeLimit
                  - maxAlertsPerIncident
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /grouping/rules:
    get:
      operationId: queryGroupingRules
      summary: Returns a full list of grouping settings
      description: |
        **NOTE:** To access Grouping Rules, user should have specific Admin privileges
      tags:
        - grouping
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                type: object
                properties:
                  results:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: 'A unique, machine-oriented ID identifying this rule.'
                          example: 5e7c6cf54b832e0018f191ad
                        title:
                          type: string
                          description: Rule title
                          example: PhishingRule
                        comment:
                          type: string
                          description: Rule comment
                          example: 5e7c6cf54b832e0018f191ad
                        order:
                          type: number
                          description: Order of rules execution
                          example: 1
                        enabled:
                          type: boolean
                          description: Defines if rule is enabled
                          example: true
                        criteria:
                          type: array
                          description: Criteria of the rule
                          items:
                            type: object
                            properties:
                              fieldName:
                                type: string
                                description: Name of the field to compare
                                example: observables
                              operator:
                                type: string
                                description: Comparison operator
                                enum:
                                  - equals
                                  - allOf
                                  - oneOf
                                example: allOf
                              matchValue:
                                description: Comparison value
                                example:
                                  - type: IPv4 address
                                  - type: IPv6 address
                            required:
                              - fieldName
                              - operator
                      required:
                        - id
                        - title
                        - order
                        - enabled
                        - criteria
                required:
                  - results
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
  /custom-fields/settings:
    get:
      operationId: queryCustomFieldsSchemasPublic
      summary: Read custom fields setting/schemas
      description: Query custom fields schema with support for filters and pagination
      parameters:
        - name: sort
          required: false
          in: query
          description: fields to sort by
          schema:
            type: array
            items:
              type: string
              enum:
                - label
                - 'label:desc'
                - fieldName
                - 'fieldName:desc'
                - entityType
                - 'entityType:desc'
                - classifications
                - 'classifications:desc'
                - scope
                - 'scope:desc'
                - order
                - 'order:desc'
                - type
                - 'type:desc'
                - visible
                - 'visible:desc'
                - deleted
                - 'deleted:desc'
        - name: includeTotal
          required: false
          in: query
          description: include total count on response (slower)
          schema:
            type: boolean
        - name: ids
          required: false
          in: query
          description: List of the db`s document identifiers
          schema:
            type: array
            items:
              type: string
        - name: type
          required: false
          in: query
          description: 'Enum values for the available data types i.e TEXT, RICH_TEXT, NUMBER etc.'
          schema:
            $ref: '#/components/schemas/CustomFieldsSchemaTypesEnum'
        - name: scope
          required: false
          in: query
          description: 'Enum values for the available scopes i.e SUMMARY, ADDITIONAL_INFO etc.'
          schema:
            $ref: '#/components/schemas/EntityScopes'
        - name: marker
          required: false
          in: query
          schema:
            type: string
        - name: label
          required: false
          in: query
          schema:
            type: string
        - name: fieldName
          required: false
          in: query
          schema:
            type: string
        - name: entityType
          required: false
          in: query
          schema:
            enum:
              - ALERT
              - INCIDENT
            type: string
        - name: classifications
          required: false
          in: query
          schema:
            type: array
            items:
              type: string
        - name: visible
          required: false
          in: query
          schema:
            type: boolean
        - name: order
          required: false
          in: query
          schema:
            minimum: 1
            type: number
        - name: deleted
          required: false
          in: query
          schema:
            type: boolean
      responses:
        '200':
          description: Response for query schema
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/QueryCustomFieldSchemaResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '410':
          $ref: '#/components/responses/Gone'
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '502':
          $ref: '#/components/responses/BadGateway'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '504':
          $ref: '#/components/responses/GatewayTimeout'
      tags:
        - custom-fields
tags:
  - name: alerts
    description: Alerts APIs
    externalDocs:
      url: 'https://en.wikipedia.org/wiki/Security_information_and_event_management'
  - name: incidents
    description: Incidents APIs
    externalDocs:
      url: 'https://en.wikipedia.org/wiki/Computer_security_incident_management'
  - name: evidence
    description: Evidence APIs
  - name: urls
    description: URL shortener APIs
  - name: observables
    description: Observables APIs
  - name: files
    description: Files APIs
  - name: search
    description: Files APIs
  - name: grouping
    description: Grouping APIs
