Custom Strategies

get

List all custom strategies. Use is_protected filter to distinguish between user-created and OOTB strategies.

Authorizations

ApiKeyAuth

AuthorizationstringRequired

Query parameters

alert_sourcesstring[]Optional

Filter by alert sources

attack_surfacesstring[]Optional

Filter by attack surfaces

is_archivedbooleanOptional

Filter by archived status

is_enabledbooleanOptional

Filter by enabled status

is_protectedbooleanOptional

Filter by protected status (true=OOTB, false=user-created)

mitre_tacticsstring[]Optional

Filter by MITRE tactics

search_querystringOptional

Search in strategy title and scenario

Responses

200

List of custom strategies

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional

attack_surfacesstring[]Optional

created_atstring · date-timeRead-onlyRequired

idintegerRead-onlyRequired

internal_origin_uuidstring · uuidRead-onlyRequired

is_archivedbooleanRead-onlyRequired

is_enabledbooleanRead-onlyRequired

is_latestbooleanRead-onlyRequired

is_protectedbooleanRead-onlyRequired

mitre_tacticsstring[]Optional

scenariostring · nullableOptional

titlestringRead-onlyRequired

total_conclusions_affectedintegerRead-onlyRequired

total_instructions_usedintegerRead-onlyRequired

total_priorities_affectedintegerRead-onlyRequired

updated_atstring · date-timeRead-onlyRequired

version_idintegerRead-onlyRequired

401

Unauthorized

application/json

403

Access denied

application/json

500

System error

application/json

503

System not ready for requests

application/json

get

/app/api/v1/custom-strategies

HTTPcURLJavaScriptPython

GET /app/api/v1/custom-strategies HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

[
  {
    "alert_sources": [
      "text"
    ],
    "attack_surfaces": [
      "text"
    ],
    "created_at": "2026-03-09T21:49:14.130Z",
    "id": 1,
    "instructions": [
      {
        "content": "text",
        "created_at": "2026-03-09T21:49:14.130Z",
        "id": 1,
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "strategy_versions": [
          1
        ],
        "usage_count": 1
      }
    ],
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "is_archived": true,
    "is_enabled": true,
    "is_latest": true,
    "is_protected": true,
    "mitre_tactics": [
      "text"
    ],
    "outcomes": [
      {
        "conclusions_affected": 1,
        "condition": {
          "ANY_ADDITIONAL_PROPERTY": "anything"
        },
        "created_at": "2026-03-09T21:49:14.130Z",
        "id": 1,
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "outcome": "COMPLETED_BREACHED_CONFIRMED",
        "strategy_versions": [
          1
        ]
      }
    ],
    "priorities": [
      {
        "created_at": "2026-03-09T21:49:14.130Z",
        "id": 1,
        "insight_tag_rule": {
          "ANY_ADDITIONAL_PROPERTY": "anything"
        },
        "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
        "outcomes": [
          "COMPLETED_BREACHED_CONFIRMED"
        ],
        "priorities_affected": 1,
        "priority": "informational",
        "ranking": 1,
        "strategy_versions": [
          1
        ]
      }
    ],
    "scenario": "text",
    "title": "text",
    "total_conclusions_affected": 1,
    "total_instructions_used": 1,
    "total_priorities_affected": 1,
    "updated_at": "2026-03-09T21:49:14.130Z",
    "version_id": 1
  }
]

post

Create a new custom strategy

Authorizations

ApiKeyAuth

AuthorizationstringRequired

Body

application/json

alert_sourcesstring[]Optional

attack_surfacesstring[]Optional

instructionsobject[]Optional

is_enabledbooleanOptionalDefault: false

mitre_tacticsstring[]Optional

outcomesobject[]Optional

prioritiesobject[]Optional

scenariostringOptional

titlestringRequired

Responses

201

Custom strategy created successfully

application/json

400

Bad request - invalid input

application/json

401

Unauthorized

application/json

403

Access denied

application/json

500

System error

application/json

503

System not ready for requests

application/json

post

/app/api/v1/custom-strategies

HTTPcURLJavaScriptPython

POST /app/api/v1/custom-strategies HTTP/1.1
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 184

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "instructions": [
    {}
  ],
  "is_enabled": false,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {}
  ],
  "priorities": [
    {}
  ],
  "scenario": "text",
  "title": "text"
}

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-03-09T21:49:14.130Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-03-09T21:49:14.130Z",
  "version_id": 1
}

get

Get a specific custom strategy by ID. Includes both user-created and OOTB (protected) strategies.

Authorizations

ApiKeyAuth

AuthorizationstringRequired

Path parameters

strategy_idintegerRequired

Responses

200

Custom strategy details

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional

attack_surfacesstring[]Optional

created_atstring · date-timeRead-onlyRequired

idintegerRead-onlyRequired

internal_origin_uuidstring · uuidRead-onlyRequired

is_archivedbooleanRead-onlyRequired

is_enabledbooleanRead-onlyRequired

is_latestbooleanRead-onlyRequired

is_protectedbooleanRead-onlyRequired

mitre_tacticsstring[]Optional

scenariostring · nullableOptional

titlestringRead-onlyRequired

total_conclusions_affectedintegerRead-onlyRequired

total_instructions_usedintegerRead-onlyRequired

total_priorities_affectedintegerRead-onlyRequired

updated_atstring · date-timeRead-onlyRequired

version_idintegerRead-onlyRequired

401

Unauthorized

application/json

403

Access denied

application/json

404

Resource not found

application/json

500

System error

application/json

503

System not ready for requests

application/json

get

/app/api/v1/custom-strategies/{strategy_id}

HTTPcURLJavaScriptPython

GET /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-03-09T21:49:14.130Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-03-09T21:49:14.130Z",
  "version_id": 1
}

put

Update a custom strategy (full replacement - creates new version)

Authorizations

ApiKeyAuth

AuthorizationstringRequired

Path parameters

strategy_idstringRequired

Body

application/json

alert_sourcesstring[]Optional

attack_surfacesstring[]Optional

instructionsobject[]Optional

is_enabledbooleanOptional

mitre_tacticsstring[]Optional

outcomesobject[]Optional

prioritiesobject[]Optional

scenariostringOptional

titlestringRequired

Responses

200

Strategy updated successfully

application/json

A serializer for a combined strategy and one of its versions.

alert_sourcesstring[]Optional

attack_surfacesstring[]Optional

created_atstring · date-timeRead-onlyRequired

idintegerRead-onlyRequired

internal_origin_uuidstring · uuidRead-onlyRequired

is_archivedbooleanRead-onlyRequired

is_enabledbooleanRead-onlyRequired

is_latestbooleanRead-onlyRequired

is_protectedbooleanRead-onlyRequired

mitre_tacticsstring[]Optional

scenariostring · nullableOptional

titlestringRead-onlyRequired

total_conclusions_affectedintegerRead-onlyRequired

total_instructions_usedintegerRead-onlyRequired

total_priorities_affectedintegerRead-onlyRequired

updated_atstring · date-timeRead-onlyRequired

version_idintegerRead-onlyRequired

400

Bad request - invalid input

application/json

401

Unauthorized

application/json

403

Access denied

application/json

500

System error

application/json

503

System not ready for requests

application/json

put

/app/api/v1/custom-strategies/{strategy_id}

HTTPcURLJavaScriptPython

PUT /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 183

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "instructions": [
    {}
  ],
  "is_enabled": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {}
  ],
  "priorities": [
    {}
  ],
  "scenario": "text",
  "title": "text"
}

{
  "alert_sources": [
    "text"
  ],
  "attack_surfaces": [
    "text"
  ],
  "created_at": "2026-03-09T21:49:14.130Z",
  "id": 1,
  "instructions": [
    {
      "content": "text",
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "strategy_versions": [
        1
      ],
      "usage_count": 1
    }
  ],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [
    "text"
  ],
  "outcomes": [
    {
      "conclusions_affected": 1,
      "condition": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcome": "COMPLETED_BREACHED_CONFIRMED",
      "strategy_versions": [
        1
      ]
    }
  ],
  "priorities": [
    {
      "created_at": "2026-03-09T21:49:14.130Z",
      "id": 1,
      "insight_tag_rule": {
        "ANY_ADDITIONAL_PROPERTY": "anything"
      },
      "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
      "outcomes": [
        "COMPLETED_BREACHED_CONFIRMED"
      ],
      "priorities_affected": 1,
      "priority": "informational",
      "ranking": 1,
      "strategy_versions": [
        1
      ]
    }
  ],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-03-09T21:49:14.130Z",
  "version_id": 1
}

delete

Delete or archive a custom strategy (archives if referenced by investigations)

Authorizations

ApiKeyAuth

AuthorizationstringRequired

Path parameters

strategy_idstringRequired

Responses

204

Strategy deleted or archived successfully

400

Cannot delete already archived strategy

application/json

401

Unauthorized

application/json

403

Access denied

application/json

404

Resource not found

application/json

500

System error

application/json

503

System not ready for requests

application/json

delete

/app/api/v1/custom-strategies/{strategy_id}

HTTPcURLJavaScriptPython

DELETE /app/api/v1/custom-strategies/{strategy_id} HTTP/1.1
Authorization: YOUR_API_KEY
Accept: */*

No content