ProductSearchCTIX

Network live

CTIXPOST

Create Custom Kill Chain

POSThttps://cs-testv2.cyware.com/ctixapi/ingestion/configuration/kill-chain/

Creates a custom kill chain with the phases of the kill chain.

Headers

Name	Type	Required	Description
accept	string	optional
content-type	string	optional

Body Parameters

Name	Type	Required	Description
name	string	required	Pass a unique name for the kill chain within 100 characters.
phases	array	required	Pass the names of the phases within 100 characters to add to the kill chain.

Playground

Request parameters

Edit values here before running any snippet below (cURL, JavaScript, or Python). Code blocks are reference only — your inputs above are what gets sent.

CTIXConnect to Intel ExchangeRequired to change data

Credentials required for POST

Open API (HMAC signature) · Get credentials from Cyware Admin → Open API → Generate Credentials.

Base URL

Access ID *Secret Key *

Signature and Expires are generated when you run a request. Access ID and Secret Key stay in memory for this tab only.

Credentials from Authentication auto-fill here for this product. If fields are empty after connecting, refresh this page or open the product docs again.

Request body (JSON)Valid JSON

cURL

curl --request POST \
  --url "https://cs-testv2.cyware.com/ctixapi/ingestion/configuration/kill-chain/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E" \
  --header "accept: application/json, text/plain, */*" \
  --data '{
  "name": "sample-killchain",
  "phases": [
    "Sample phase 1"
  ]
}'

View-only example — running live API calls requires a role with snippet testing access.

JavaScript

const url = "https://cs-testv2.cyware.com/ctixapi/ingestion/configuration/kill-chain/?AccessID=%3Cyour%20access%20id%3E&Signature=%3Cyour%20signature%3E&Expires=%3Cyour%20expires%3E";

const response = await fetch(url, {
  method: "POST",
  headers: {
    "accept": "application/json, text/plain, */*"
  },
  body: JSON.stringify({
    "name": "sample-killchain",
    "phases": [
      "Sample phase 1"
    ]
  }),
});

const text = await response.text();
let data;
try { data = JSON.parse(text); } catch { data = text; }
console.log(response.status, data);

View-only example — running live API calls requires a role with snippet testing access.

Python

import requests

url = "https://cs-testv2.cyware.com/ctixapi/ingestion/configuration/kill-chain/"
params = {
    "AccessID": "<your access id>",
    "Signature": "<your signature>",
    "Expires": "<your expires>"
}
headers = {
    "accept": "application/json, text/plain, */*"
}
payload = {
  "name": "sample-killchain",
  "phases": [
    "Sample phase 1"
  ]
}
response = requests.request("POST", url, params=params, headers=headers, json=payload)
print(response.status_code)
print(response.text)

View-only example — running live API calls requires a role with snippet testing access.

Request Body

{
  "name": "sample-killchain",
  "phases": [
    "Sample phase 1"
  ]
}

View-only example — running live API calls requires a role with snippet testing access.

Example Response

{
  "created_by": {},
  "ctix_created": 1712925852,
  "ctix_modified": 1712925852,
  "id": "22a47429-603e-440e-83d0-c19323d7b5aa",
  "modified_by": {},
  "name": "sample-killchain",
  "phases": [
    "Sample phase 2"
  ]
}

View-only example — running live API calls requires a role with snippet testing access.