mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
96 lines
3.9 KiB
JSON
96 lines
3.9 KiB
JSON
{
|
|
"create_time": "2026-03-12T01:52:29.767919+00:00",
|
|
"custom_function_id": "b705f07c883eae033c60aebe4779bd4eba61121d",
|
|
"description": "Create a new artifact with the specified attributes. Supports all fields available in /rest/artifact. Add any unlisted inputs as dictionary keys in input_json. Unsupported keys will automatically be dropped.",
|
|
"draft_mode": false,
|
|
"inputs": [
|
|
{
|
|
"contains_type": [
|
|
"phantom container id"
|
|
],
|
|
"description": "Container which the artifact will be added to.",
|
|
"input_type": "item",
|
|
"name": "container",
|
|
"placeholder": "container:id"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "The name of the new artifact, which is optional and defaults to \"artifact\".",
|
|
"input_type": "item",
|
|
"name": "name",
|
|
"placeholder": "artifact"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "The label of the new artifact, which is optional and defaults to \"events\"",
|
|
"input_type": "item",
|
|
"name": "label",
|
|
"placeholder": "events"
|
|
},
|
|
{
|
|
"contains_type": [
|
|
""
|
|
],
|
|
"description": "The severity of the new artifact, which is optional and defaults to \"Medium\". Typically this is either \"High\", \"Medium\", or \"Low\".",
|
|
"input_type": "item",
|
|
"name": "severity",
|
|
"placeholder": "Medium"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "The name of the CEF field to populate in the artifact, such as \"destinationAddress\" or \"sourceDnsDomain\". Required only if cef_value is provided.",
|
|
"input_type": "item",
|
|
"name": "cef_field",
|
|
"placeholder": "destinationAddress"
|
|
},
|
|
{
|
|
"contains_type": [
|
|
"*"
|
|
],
|
|
"description": "The value of the CEF field to populate in the artifact, such as the IP address, domain name, or file hash. Required only if cef_field is provided.",
|
|
"input_type": "item",
|
|
"name": "cef_value",
|
|
"placeholder": "192.0.2.192"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "The CEF data type of the data in cef_value. For example, this could be \"ip\", \"hash\", or \"domain\". Optional.",
|
|
"input_type": "item",
|
|
"name": "cef_data_type",
|
|
"placeholder": "ip"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "A comma-separated list of tags to apply to the created artifact, which is optional.",
|
|
"input_type": "item",
|
|
"name": "tags",
|
|
"placeholder": "tag1, tag2, tag3"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "Either \"true\" or \"false\", depending on whether or not the new artifact should trigger the execution of any playbooks that are set to active on the label of the container the artifact will be added to. Optional and defaults to \"false\".",
|
|
"input_type": "item",
|
|
"name": "run_automation",
|
|
"placeholder": "false"
|
|
},
|
|
{
|
|
"contains_type": [],
|
|
"description": "Optional parameter to modify any extra attributes of the artifact. Input_json will be merged with other inputs. In the event of a conflict, input_json will take precedence.",
|
|
"input_type": "item",
|
|
"name": "input_json",
|
|
"placeholder": "{\"source_data_identifier\": \"1234\", \"data\": \"5678\"}"
|
|
}
|
|
],
|
|
"outputs": [
|
|
{
|
|
"contains_type": [
|
|
"phantom artifact id"
|
|
],
|
|
"data_path": "artifact_id",
|
|
"description": "The ID of the created artifact."
|
|
}
|
|
],
|
|
"outputs_type": "item",
|
|
"platform_version": "8.4.0.158",
|
|
"python_version": "3.13"
|
|
} |