Orchestrate API Reference

Sections

Theme switcher

Orchestrate API Reference

Orchestrate enables security analysts to gather threat data from multiple sources and automate responses to threats and vulnerabilities through advanced workflows. This leads to faster detection, improved analysis, and efficient management of the security operations lifecycle. For more information, see Orchestrate Product Documentation.

The Orchestrate open API allows for programmatic interaction with Orchestrate services, enabling automation and integration with other systems in your environment.

Supported Orchestrate Version: 3.5.5.0 and later versions.

The API reference includes public Orchestrate API endpoints for the following modules:

Integrations

Integrate security tools seamlessly with Orchestrate's App Store.

Playbooks

Automate and orchestrate security operations with playbooks.

Authenticate

Custom Templates

Code Snippets

Persistent List

Analytics

Events

Tags

Webhooks

Was this section helpful?

What made this section unhelpful for you?

Base URL

Sample:

https://tenantname.cyware.com/soarapi/openapi/

Was this section helpful?

What made this section unhelpful for you?

Authentication

Users with access to Cyware Orchestrate's Open APIs module can generate the credentials for API authentication.

Generate Open API Credentials

You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see Configure Open API.

Mandatory Query Parameters for Requests

After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:

  • Access ID: Indicates the access ID linked to your Orchestrate Open API. For example, 57d008xx-7xxx-xx-b27a-1feb943d0xxx.
  • Expires: Indicates the validity of the signature parameter. The signature becomes invalid if not used within the specified expiry duration. You can use expires = current time + 30 seconds for authentication. You can specify a margin of 10 to 30 seconds for expiration.
  • Signature: Signature is a combination of the access ID, secret key, and expiration parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.
    • Create a StringToSign value using the StringToSign = access_id + \n + expires formula.
    • Create a Signature value using the Signature = Base64(HMAC-SHA1UTF-8-Encoding-Of(secret_key), UTF-8-Encoding-Of(StringToSign)) formula.

The following Python code is a sample to generate a signature for endpoint authentication:

Python
def generate_signature(access_id, secret_key):
    expires = int(time.time() + 30) # expires in 30 seconds
    to_sign = '{}\n{}'.format(access_id, expires)
    signature = base64.b64encode(
       hmac.new(
           secret_key.encode('utf-8'),
           to_sign.encode('utf-8'),
           hashlib.sha1
       ).digest()).decode()
    return expires, signature
#Example:
#access_id = "7e4e6a9c-11ca-40f4-95af-edae017358d0"
#secret_key = "e61e92fb-bfd9-4cef-9b21-6f1e8211b77b"
#Generate signature:
#expires, signature = generate_signature(access_id, secret_key)

Integrations

Cyware Orchestrate offers a robust App Store with a comprehensive library of apps required to integrate, orchestrate, and respond using various security tools within your organization. These integrations support tasks like threat data collection, prioritization, and other analytics, enabling a holistic approach to orchestration from a unified platform. For more information, see Integrations.

You can perform the following actions in this module:

  • Retrieve App and Instance Details: Fetch details of available apps and instances, including details of a specific app and instance.
  • Test Instance Connectivity: Verify the connectivity of a specific app instance to ensure successful integration.
  • Retrieve App Actions and Details: Fetch a list of actions associated with an app and detailed information about each action.
  • Execute App Actions: Run specific actions of an app.
  • Download App Package: Download the ZIP file for a specific app to enable offline access.
  • Install Custom Apps: Add new custom applications by uploading and installing app packages.

Endpoints

GET
GET
GET
POST
GET
GET
GET
GET
POST
GET
POST

Playbooks

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization's specific needs.

Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see Playbooks.

You can perform the following actions in this module:

  • Export Playbook: Export playbook details for backup or external use.
  • Retrieve Playbooks and Details: Fetch the list of playbooks and specific playbook details.
  • Retrieve Playbook Run Logs and Run Details: Fetch the list of playbook results, run logs, and specific run log details.
  • Execute and Manage Playbooks: Run or terminate specific playbooks.
  • Download Playbook and Node Results: Fetch and download results of a specific playbook or a specific node output for analysis.

Endpoints

GET
GET
GET
GET
GET
GET
POST
GET
GET
GET
POST

Custom Email Templates

Email templates are predefined email layouts with a header and body in rich text format. Analysts can reuse and customize these templates, reducing the effort required to compose emails from scratch.

These templates can be used in playbooks to automate email notifications. They are compatible with applications that support Rich Text Format fields, such as the Cyware Email Service - Send Email in Rich Text Format action and more. For more information, see Email Templates.

You can perform the following actions in this module:

  • Get Custom Email Template List: Retrieve a list of available email templates.
  • Get Custom Email Template Details: Retrieve detailed information about a specific email template.
Was this section helpful?

What made this section unhelpful for you?

Endpoints

GET
GET
Was this section helpful?

What made this section unhelpful for you?

Get Custom Email Template List

Returns the list of custom email templates.

Query Parameters

pageinteger

Pass the page number to retrieve the templates list.

Default value
1
page_sizeinteger

Pass the number of items to retrieve per page.

Default value
10
qstring

Pass a value to q to search for custom templates. You can search email templates using the title.

Response

200
Object

Response Attributes

linkobject

Indicates the next and the previous URLs of the email templates list.

Show child attributes

countnumber

Returns the total count of the custom email templates.

resultsarray

Returns the list of the custom templates.

Show child attributes

Was this section helpful?

What made this section unhelpful for you?

GET

/v1/custom-templates/?page=1&page_size=1&q=example-template

Select
1 curl --location 'https://tenantname.cyware.com/soarapi/openapi/v1/custom-templates/?page=1&page_size=1&q=example-template' \

Response

{
  "link": {
    "next": "custom-templates/?page=2&page_size=1"
  },
  "count": 18,
  "results": [
    {
      "unique_id": "6bd5a80a-722c-45d0-a24d-8a0ab72ae12a",
      "title": "Phishing Template",
      "description": "This will be the Phishing Template",
      "is_removed": false,
      "created": "2023-06-07T08:34:05.361364Z",
      "created_by_data": {
        "unique_id": "0832ea94-0252-49b2-80c1-9823b44a3f46",
        "first_name": "john",
        "last_name": "doe",
        "full_name": "john doe"
      }
    }
  ]
}
Was this section helpful?

What made this section unhelpful for you?

Get Custom Email Template Details

Returns details of a specific custom email template.

Path Parameters

unique_idstring

Pass the unique ID of the custom template. You can retrieve the unique ID of a custom email template using the Get Custom Template List endpoint.

Response

200
Object

Response Attributes

unique_idstring

Returns the unique ID of the custom email template.

titlestring

Returns the title of the custom template.

descriptionstring

Returns the description of the custom email template.

template_bodystring

Returns the HTML template of the email content in string format.

is_removedboolean

Indicates if the custom template is deleted or not.

createdstring

Returns the date and time of when the custom template was created.

created_by_dataobject

Returns the details of the user who created the custom template.

Show child attributes

Was this section helpful?

What made this section unhelpful for you?

GET

/v1/custom-templates/{unique_id}/

Select
1 curl --location --globoff 'https://tenantname.cyware.com/soarapi/openapi/v1/custom-templates/{custom_template_unique_id}/' \

Response

{
  "unique_id": "6bd5a80a-722c-45d0-a24d-8a0ab72ae12a",
  "title": "Phishing Template",
  "description": "This will be the Phishing Template",
  "template_body": "<table style=\"Margin:0;background:#f4f5f7 !important;border-collapse:collapse;border-spacing:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;height:100%;line-height:1.3;margin:0;padding:0;text-align:left;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td align=\"center\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;hyphens:auto;line-height:1.3;margin:0;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"><div data-parsed style=\"min-width:580px;width:100%\"><table align=\"center\" style=\"Margin:0 auto;background:#f3f3f3;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:center;vertical-align:top;width:580px\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;hyphens:auto;line-height:1.3;margin:0;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"><table style=\"border-collapse:collapse;border-spacing:0;display:table;padding:0;position:relative;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:0;padding-left:0;padding-right:0;text-align:left;width:588px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td height=\"32px\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:32px;font-weight:400;hyphens:auto;line-height:32px;margin:0;mso-line-height-rule:exactly;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"> </td></tr></tbody></table><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td height=\"32px\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:32px;font-weight:400;hyphens:auto;line-height:32px;margin:0;mso-line-height-rule:exactly;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"> </td></tr></tbody></table></th><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0 !important;text-align:left;visibility:hidden;width:0\"><br /></th></tr></thead></table></th></tr></thead></table></td></tr></tbody></table><table align=\"center\" style=\"Margin:0 auto;background:#fefefe;border-collapse:collapse;border-radius:7px 7px 7px 7px;border-spacing:0;box-shadow:0 0 5px rgba(0,0,0,.2);float:none;margin:0 auto;padding:0;text-align:center;vertical-align:top;width:580px\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;hyphens:auto;line-height:1.3;margin:0;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"><table style=\"border-collapse:collapse;border-spacing:0;display:table;padding:0;position:relative;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:16px;padding-right:8px;text-align:left;width:32.33px\"><br /></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:8px;text-align:left;width:467.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"></tr></thead></table></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:16px;text-align:left;width:32.33px\"><br /></th></tr></thead></table><table style=\"border-collapse:collapse;border-spacing:0;display:table;padding:0;position:relative;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:16px;padding-right:8px;text-align:left;width:32.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><br /></th></tr></thead></table></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:8px;text-align:left;width:467.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\">Dear <strong>{{user}}</strong>,</p><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\"><span style=\"color:rgb(51, 51, 51);font-family:\"Helvetica Neue\", Helvetica, Arial, sans-serif;font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;orphans:2;text-align:start;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline !important;float:none\"><span style=\"color:rgb(51, 51, 51);font-family:\"Helvetica Neue\", Helvetica, Arial, sans-serif;font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;orphans:2;text-align:start;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline !important;float:none\">Our </span><strong>{{organization}}</strong> regularly conducts phishing campaigns to ensure user awareness about the rampant increase of phishing incidents across the globe and the serious consequences of falling prey to such incidents.</span></p><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\"><span><span style=\"color:rgb(51, 51, 51);font-family:\"Helvetica Neue\", Helvetica, Arial, sans-serif;font-size:14px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;orphans:2;text-align:start;text-indent:0px;text-transform:none;white-space:normal;widows:2;word-spacing:0px;-webkit-text-stroke-width:0px;background-color:rgb(255, 255, 255);text-decoration-thickness:initial;text-decoration-style:initial;text-decoration-color:initial;display:inline !important;float:none\">You have recently clicked on a malicious link without proper assessment. Your reporting manager has been informed about this and will discuss with you regarding the next steps. We request you to go through the security awareness training and familiarize yourself with the signs of a phishing email and the best practices to avoid phishing attacks. Please reach out to the security administrator for any queries or details.</span></span></p><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\"><br /></p><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\"><span><span>Regards,</span></span></p><p style=\"Margin:0;Margin-bottom:10px;color:#000;font-family:Helvetica,Arial,sans-serif;font-size:14px;font-weight:400;line-height:1.3;margin:0;margin-bottom:10px;padding:0;text-align:left\"><span><span><strong>Security Team</strong></span></span></p><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td height=\"10px\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:10px;font-weight:400;hyphens:auto;line-height:10px;margin:0;mso-line-height-rule:exactly;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"><br /></td></tr></tbody></table></th></tr></thead></table></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:16px;text-align:left;width:32.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><br /></th></tr></thead></table></th></tr></thead></table><table><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:16px;padding-right:8px;text-align:left;width:32.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><br /></th></tr></thead></table></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:8px;text-align:left;width:467.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><div align=\"center\" style=\"color:#fff;font-family:Arial;font-size:14px;line-height:18px;margin-top:10px;text-align:center\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td height=\"7px\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:7px;font-weight:400;hyphens:auto;line-height:7px;margin:0;mso-line-height-rule:exactly;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"> </td></tr></tbody></table></div></th></tr></thead></table></th><th style=\"Margin:0 auto;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0 auto;padding:0;padding-bottom:16px;padding-left:8px;padding-right:16px;text-align:left;width:32.33px\"><table style=\"border-collapse:collapse;border-spacing:0;padding:0;text-align:left;vertical-align:top;width:100%\"><thead><tr style=\"padding:0;text-align:left;vertical-align:top\"><th style=\"Margin:0;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:16px;font-weight:400;line-height:1.3;margin:0;padding:0;text-align:left\"><br /></th></tr></thead></table></th></tr></thead></table></td></tr></tbody></table><table style=\"Margin:0 auto;border-collapse:collapse;border-spacing:0;float:none;margin:0 auto;padding:0;text-align:center;vertical-align:top;width:100%\"><tbody><tr style=\"padding:0;text-align:left;vertical-align:top\"><td height=\"40px\" style=\"-moz-hyphens:auto;-webkit-hyphens:auto;Margin:0;border-collapse:collapse !important;color:#0a0a0a;font-family:Helvetica,Arial,sans-serif;font-size:40px;font-weight:400;hyphens:auto;line-height:40px;margin:0;mso-line-height-rule:exactly;padding:0;text-align:left;vertical-align:top;word-wrap:break-word\"> </td></tr></tbody></table></div></td></tr></tbody></table><div style=\"display:none;white-space:nowrap;font:15px courier;line-height:0\"><br /></div>",
  "is_removed": false,
  "created": "2023-06-07T08:34:05.361364Z",
  "created_by_data": {
    "unique_id": "0832ea94-0252-49b2-80c1-9823b44a3f46",
    "first_name": "system",
    "last_name": "default",
    "full_name": "system default"
  }
}
Was this section helpful?

What made this section unhelpful for you?

Code Snippets

Code snippets are reusable blocks of code, such as functions, loops, and conditional statements. They support the creation of custom nodes, including custom actions and conditions, within playbooks.

Analysts can leverage a centralized library of reusable code to streamline workflows and reduce effort. This allows them to customize code pieces that are used in multiple playbook workflows from one location. For more information, see Code Snippets.

You can perform the following actions in this module:

  • Retrieve Code Snippets: Retrieve a list of available code snippets.
  • Retrieve Code Snippet Details: Fetch detailed information about a specific code snippet.

Endpoints

GET
GET

Persistent List

Persistent List is a collection of key-value pairs that analysts can use to store data and then look up from this data to use in a playbook or playbook node. Data stored in a persistent list can survive system reboots, system crashes, and more. Analysts can then retrieve the data defined in a persistent list using any playbook node. For more information, see Persistent List.

You can perform the following actions in this module:

  • Retrieve Persistent Lists and Details: Fetch a list of all persistent storage objects and fetch detailed information about a specific object using its unique identifier.
  • Create and Update Persistent Lists: Create new persistent storage objects or modify existing ones to update their details.
  • Delete Persistent Storage Objects: Remove a specific persistent storage object from Orchestrate.
  • Retrieve Persistent List Slugs: Get a list of unique resource identifiers for all persistent lists.
  • Retrieve Playbooks Associated with a Persistent List: Get details and count of playbooks associated with a specific persistent storage object.

Endpoints

GET
GET
POST
PUT
PUT
GET
GET
GET

Analytics

The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see Analytics Dashboard.

You can perform the following actions in this module:

  • Retrieve Playbook Execution Metrics: Get insights on playbook run count, most active playbooks, and average playbook execution time.
  • Retrieve App and Instance Usage Metrics: Get insights into the most used and most active apps, instances, and actions.
  • Retrieve Event Processing Metrics: Get insights on event count, unprocessed events, events with errors, and incoming source events.

Endpoints

GET
GET
GET
GET
GET
GET
GET
GET
GET
GET
GET
GET
GET

Events

A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see Events.

When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.

Authorization

These APIs require an OpenAPI access ID and a generated secret key for authentication.

You can perform the following actions in this module:

  • Create Events: Create new events with either detailed or concise response data.
  • Retrieve Source Events and Details: Fetch a list of all source events and retrieve the details of a specific event.
  • Configure and Manage Events: Configure events by passing the app identifier, action identifier, and labels through the payload.
  • Download Event Data: Export event data for further analysis.

Endpoints

POST
POST
GET
GET
POST
GET

Tags

A playbook tag can be used to define role-based access control (RBAC) for playbooks. To configure RBAC, analysts must create playbook tags and associate them with both playbooks and user groups in Respond. Members of a Respond user group can execute playbooks only if the assigned tags match those of the user group. For more information, see Create Playbook Tags.

You can perform the following actions in this module:

  • Retrieve Tags: Fetch the list of tags.
  • Retrieve Tag Details: Fetch the details of a specific tag.

Endpoints

GET
GET

Webhooks

Webhooks are serialized messages/information sent from one application to another's unique URL over the web. Webhooks enable analysts to bypass data exchange complications by generating token-based URLs and authenticating endpoints whenever events (GET and POST requests) are triggered in the Orchestrate application.

Webhooks module allows users to create and manage webhook configurations and tokens. Users will be able to access features based on the permissions assigned to the user in the Orchestrate application. For more information, see Configure Webhooks.

Authentication

These APIs require a webhook token as a mandatory parameter.

Generate Webhook Credentials

  1. Navigate to the Admin Panel and select Webhooks.
  2. Click Add Webhook and enter the webhook details.
  3. After entering the details, click Generate Webhook URL.
  4. After the webhook URL is generated, copy the token and the Base URL displayed to you, and then configure the keys in the required application.

You can perform the following actions in this module:

  • Test Connectivity: Verify the webhook connection to ensure a successful event creation.
  • Create Events: Create new events with either detailed or concise response data.
  • Create Events through Payload: Create new events by passing the app identifier, action identifier, and data through the payload.

Endpoints

GET
POST
POST
POST
POST