Ctrlk
WebsiteTest DriveStatus
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Custom Strategies

get

List all custom strategies. Use is_protected filter to distinguish between user-created and OOTB strategies.

Authorizations
AuthorizationstringRequired
Query parameters
alert_sourcesstring[]Optional

Filter by alert sources

attack_surfacesstring[]Optional

Filter by attack surfaces

is_archivedbooleanOptional

Filter by archived status

is_enabledbooleanOptional

Filter by enabled status

is_protectedbooleanOptional

Filter by protected status (true=OOTB, false=user-created)

mitre_tacticsstring[]Optional

Filter by MITRE tactics

search_querystringOptional

Search in strategy title and scenario

Responses
200

List of custom strategies

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
created_atstring · date-timeRead-onlyRequired
idintegerRead-onlyRequired
internal_origin_uuidstring · uuidRead-onlyRequired
is_archivedbooleanRead-onlyRequired
is_enabledbooleanRead-onlyRequired
is_latestbooleanRead-onlyRequired
is_protectedbooleanRead-onlyRequired
mitre_tacticsstring[]Optional
scenariostring · nullableOptional
titlestringRead-onlyRequired
total_conclusions_affectedintegerRead-onlyRequired
total_instructions_usedintegerRead-onlyRequired
total_priorities_affectedintegerRead-onlyRequired
updated_atstring · date-timeRead-onlyRequired
version_idintegerRead-onlyRequired
get/app/api/v1/custom-strategies
GET /app/api/v1/custom-strategies HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

[
  {
    "alert_sources": [
      "text"
    ],
    "attack_surfaces": [
      "text"
    ],
    "created_at": "2026-01-01T00:00:00.000Z",
    "id": 1,
    "instructions": [
      {
        "content": "text",
        "created_at": "2026-01-01T00:00:00.000Z",
        "id": 1,
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "strategy_versions": [
          1
        ],
        "usage_count": 1
      }
    ],
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "is_archived": true,
    "is_enabled": true,
    "is_latest": true,
    "is_protected": true,
    "mitre_tactics": [
      "text"
    ],
    "outcomes": [
      {
        "conclusions_affected": 1,
        "condition": {
          "ANY_ADDITIONAL_PROPERTY": "anything"
        },
        "created_at": "2026-01-01T00:00:00.000Z",
        "id": 1,
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "outcome": "COMPLETED_BREACHED_CONFIRMED",
        "strategy_versions": [
          1
        ]
      }
    ],
    "priorities": [
      {
        "created_at": "2026-01-01T00:00:00.000Z",
        "id": 1,
        "insight_tag_rule": {
          "ANY_ADDITIONAL_PROPERTY": "anything"
        },
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "outcomes": [
          "COMPLETED_BREACHED_CONFIRMED"
        ],
        "priorities_affected": 1,
        "priority": "informational",
        "ranking": 1,
        "strategy_versions": [
          1
        ]
      }
    ],
    "scenario": "text",
    "title": "text",
    "total_conclusions_affected": 1,
    "total_instructions_used": 1,
    "total_priorities_affected": 1,
    "updated_at": "2026-01-01T00:00:00.000Z",
    "version_id": 1
  }
]
post

Create a new custom strategy

Authorizations
AuthorizationstringRequired
Body
alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
instructionsobject[]Optional
is_enabledbooleanOptionalDefault: false
mitre_tacticsstring[]Optional
outcomesobject[]Optional
prioritiesobject[]Optional
scenariostringOptional
titlestringRequired
Responses
201

Custom strategy created successfully

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
created_atstring · date-timeRead-onlyRequired
idintegerRead-onlyRequired
internal_origin_uuidstring · uuidRead-onlyRequired
is_archivedbooleanRead-onlyRequired
is_enabledbooleanRead-onlyRequired
is_latestbooleanRead-onlyRequired
is_protectedbooleanRead-onlyRequired
mitre_tacticsstring[]Optional
scenariostring · nullableOptional
titlestringRead-onlyRequired
total_conclusions_affectedintegerRead-onlyRequired
total_instructions_usedintegerRead-onlyRequired
total_priorities_affectedintegerRead-onlyRequired
updated_atstring · date-timeRead-onlyRequired
version_idintegerRead-onlyRequired
post/app/api/v1/custom-strategies
POST /app/api/v1/custom-strategies HTTP/1.1
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 184

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "instructions": [
    {}
  ],
  "is_enabled": false,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {}
  ],
  "priorities": [
    {}
  ],
  "scenario": "text",
  "title": "text"
}
{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-01-01T00:00:00.000Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-01-01T00:00:00.000Z",
  "version_id": 1
}
get

Get a specific custom strategy by ID. Includes both user-created and OOTB (protected) strategies.

Authorizations
AuthorizationstringRequired
Path parameters
strategy_idintegerRequired
Responses
200

Custom strategy details

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
created_atstring · date-timeRead-onlyRequired
idintegerRead-onlyRequired
internal_origin_uuidstring · uuidRead-onlyRequired
is_archivedbooleanRead-onlyRequired
is_enabledbooleanRead-onlyRequired
is_latestbooleanRead-onlyRequired
is_protectedbooleanRead-onlyRequired
mitre_tacticsstring[]Optional
scenariostring · nullableOptional
titlestringRead-onlyRequired
total_conclusions_affectedintegerRead-onlyRequired
total_instructions_usedintegerRead-onlyRequired
total_priorities_affectedintegerRead-onlyRequired
updated_atstring · date-timeRead-onlyRequired
version_idintegerRead-onlyRequired
get/app/api/v1/custom-strategies/{strategy_id}
GET /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-01-01T00:00:00.000Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-01-01T00:00:00.000Z",
  "version_id": 1
}
put

Update a custom strategy (full replacement - creates new version)

Authorizations
AuthorizationstringRequired
Path parameters
strategy_idstringRequired
Body
alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
instructionsobject[]Optional
is_enabledbooleanOptional
mitre_tacticsstring[]Optional
outcomesobject[]Optional
prioritiesobject[]Optional
scenariostringOptional
titlestringRequired
Responses
200

Strategy updated successfully

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional
attack_surfacesstring[]Optional
created_atstring · date-timeRead-onlyRequired
idintegerRead-onlyRequired
internal_origin_uuidstring · uuidRead-onlyRequired
is_archivedbooleanRead-onlyRequired
is_enabledbooleanRead-onlyRequired
is_latestbooleanRead-onlyRequired
is_protectedbooleanRead-onlyRequired
mitre_tacticsstring[]Optional
scenariostring · nullableOptional
titlestringRead-onlyRequired
total_conclusions_affectedintegerRead-onlyRequired
total_instructions_usedintegerRead-onlyRequired
total_priorities_affectedintegerRead-onlyRequired
updated_atstring · date-timeRead-onlyRequired
version_idintegerRead-onlyRequired
put/app/api/v1/custom-strategies/{strategy_id}
PUT /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 183

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "instructions": [
    {}
  ],
  "is_enabled": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {}
  ],
  "priorities": [
    {}
  ],
  "scenario": "text",
  "title": "text"
}
{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-01-01T00:00:00.000Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-01-01T00:00:00.000Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-01-01T00:00:00.000Z",
  "version_id": 1
}
delete

Delete or archive a custom strategy (archives if referenced by investigations)

Authorizations
AuthorizationstringRequired
Path parameters
strategy_idstringRequired
Responses
204

Strategy deleted or archived successfully

No content
delete/app/api/v1/custom-strategies/{strategy_id}
DELETE /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

No content
PreviousContext Memory
NextEmail

Last updated

Was this helpful?