Cyware

Users with access to Cyware Orchestrate's Open APIs module can generate the credentials for API authentication.

Generate Open API Credentials
-----------------------------

You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see [Configure Open API](https://techdocs.cyware.com/conextgen/en/configure-open-api.html).

### Mandatory Query Parameters for Requests

After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:

*   **Access ID**: Indicates the access ID linked to your Orchestrate Open API. For example, 57d008xx-7xxx-xx-b27a-1feb943d0xxx.
*   **Expires**: Indicates the validity of the signature parameter. The signature becomes invalid if it is not used within the specified expiration duration. You can use expires = current time + 30 seconds for authentication. You can specify a margin of 10 to 30 seconds for expiration.
*   **Signature**: Signature is a combination of the access ID, secret key, and expiration parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.
*   Create a StringToSign value using the `StringToSign = access_id + \n + expires` formula.
*   Create a Signature value using the `Signature = Base64(HMAC-SHA1UTF-8-Encoding-Of(secret_key), UTF-8-Encoding-Of(StringToSign))` formula.

The following Python code is a sample to generate a signature for endpoint authentication:

<CodeBlock attributes='{"isFitToPage":false,"style":{},"lang":"python","label":"Python"}'> <CodeLine>def generate_signature(access_id, secret_key):</CodeLine> <CodeLine>    expires = int(time.time() + 30) # expires in 30 seconds</CodeLine> <CodeLine>    to_sign = '{}\n{}'.format(access_id, expires)</CodeLine> <CodeLine>    signature = base64.b64encode(</CodeLine> <CodeLine>       hmac.new(</CodeLine> <CodeLine>           secret_key.encode('utf-8'),</CodeLine> <CodeLine>           to_sign.encode('utf-8'),</CodeLine> <CodeLine>           hashlib.sha1</CodeLine> <CodeLine>       ).digest()).decode()</CodeLine> <CodeLine>    return expires, signature</CodeLine> <CodeLine></CodeLine> <CodeLine></CodeLine> <CodeLine>#Example:</CodeLine> <CodeLine>#access_id = "7e4e6a9c-11ca-****-95af-ed**017358d0"</CodeLine> <CodeLine>#secret_key = "e61e92fb-****-4cef-9b21-6f1e8211b77b"</CodeLine> <CodeLine>#Generate signature:</CodeLine> <CodeLine>#expires, signature = generate_signature(access_id, secret_key)</CodeLine> </CodeBlock>


Authentication

Returns the status of the test connectivity with the Orchestrate application.

Test Connectivity

Returns the current release version of the Orchestrate instance.

Product Release Version

Cyware Orchestrate offers a robust App Store with a comprehensive library of apps required to integrate, orchestrate, and respond using various security tools within your organization. These integrations support tasks such as threat data collection, prioritization, and other analytics, enabling a holistic approach to orchestration from a unified platform.

For more information, see [Integrations](https://techdocs.cyware.com/en/896713-923157-apps.html).

You can perform the following action in this module:

**Retrieve Apps:** Fetch the list of apps installed in the Orchestrate platform.


Integrations

Returns a list of apps from **My Apps** in Orchestrate.

Get Apps

Returns the details of a specific app including its configuration template and available actions count.

Get App Details

Returns a paginated list of app instances configured in Orchestrate.

List App Instances

Creates a new app instance with the specified configuration.

Create App Instance

Returns the configuration and connectivity details of a specific app instance.

Get App Instance

Tests the connectivity of a specific app instance and returns the connection status.

Test App Instance Connectivity

Returns a list of actions available for a specific app.

Get App Actions

Returns the details of a specific app action including its accepted parameters and return values.

Get Action Details

Execute Action

Downloads the app package file for a specific installed app.

Export App Package

Uploads and installs a custom app package into Orchestrate.

Install App

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization's specific needs.

Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see [Playbooks](https://techdocs.cyware.com/conextgen/en/playbooks.html).

You can perform the following actions in this module:

*   **Retrieve Playbooks and Details**: Fetch the list of playbooks and specific playbook details.
*   **Retrieve Playbook Run Logs and Run Details**: Fetch the list of playbook results and specific run log details.
*   **Execute and Manage Playbooks**: Run or terminate specific playbooks.


Playbooks

Returns the export of a playbook in JSON format.

Export Playbook

Returns the playbook runlogs based on the unique ID of the playbook. If no payload is passed, it returns the complete list of playbook run logs.

Get Playbook Run Logs

Returns the run logs details of a specific playbook run.

Get Playbook Run Log Details

Returns the run logs for a specific playbook.

Get Playbook Run Logs by Playbook

Filter Playbooks

Run a playbook by passing the playbook's unique ID through the payload.

Run Playbook

Returns a list of active playbooks in Orchestrate.

Get Playbook List

Downloads the input data that was passed to a specific playbook run.

Export Playbook Result

Downloads the input data for a specific node within a playbook run. Use this endpoint for large node input payloads.

Export Node Result

Terminate playbook runs in bulk. You can terminate a maximum of 100 playbook runs at a time with the run status in progress, in-queue, waiting, or on hold.

Bulk Terminate Playbook Run Logs

Custom Email Templates

Returns a paginated list of all custom email templates in the workspace.

Get Custom Email Template List

Returns the details and HTML body of a specific email template.

Get Email Template Details

Code Snippets

Returns a paginated list of all code snippets in the workspace.

Get Code Snippet List

Returns the details and source code of a specific code snippet.

Get Code Snippet Details

Persistent List

Returns a paginated list of all persistent lists in the workspace.

Get Persistent Lists

Create Persistent List

Returns the details and data of a specific persistent list.

Get Persistent List Details

Updates the data or metadata of an existing persistent list.

Update Persistent List

Delete Persistent List

Returns the list of slugs for all persistent lists in the workspace.

Get Persistent List Slugs

Returns the list of playbooks that reference a specific persistent list.

Get Associated Playbooks

Returns the number of playbooks that reference a specific persistent list.

Get Associated Playbook Count

<span style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255)">The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see</span> [Analytics Dashboard](https://techdocs.cyware.com/conextgen/en/analytics-dashboard.html).

You can perform the following actions in this module:

*   **Retrieve Most Used Apps**: Get insights into the most used apps.
*   **Retrieve Event Processing Metrics**: Get insights on event count, unprocessed events, events with errors, and incoming source events.
*   **Retrieve Playbook Run Count**: Get insights on playbook run count.


Analytics

Returns the number of times playbooks were executed for the non-purged data within the specified date range.

Get Analytics Data

A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see [Events](https://techdocs.cyware.com/conextgen/en/labels,-triggers,-and-events.html##).

When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.

You can perform the following actions in this module:

*   **Create Events**: Create new events with either detailed or concise response data.
*   **Retrieve Events and Details**: Fetch a list of all events and retrieve the details of a specific event.


Events

Creates an event by passing the app identifier, action identifier, and data through the payload.

Create Event

List Source Events

Source Event Details

Creates a new webhook trigger configuration by mapping an app identifier and action identifier to a playbook trigger.

Configure Trigger

Returns a token that can be used to download the raw data payload associated with a specific event.

Export Event Data

Get Tags List

Get Tag Details

Default

Orchestrate Next Gen API Reference

Production

Sandbox

<p class="slate-p " >Users with access to Cyware Orchestrate’s Open APIs module can generate the credentials for API authentication.</p><h2 class="slate-h2 " >Generate Open API Credentials</h2><p class="slate-p " >You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see <a href="https://techdocs.cyware.com/conextgen/en/configure-open-api.html" target="_self">Configure Open API</a>.</p><h3 class="slate-h3 " >Mandatory Query Parameters for Requests</h3><p class="slate-p " >After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access ID</strong>: Indicates the access ID linked to your Orchestrate Open API. For example, 57d008xx-7xxx-xx-b27a-1feb943d0xxx.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Expires</strong>: Indicates the validity of the signature parameter. The signature becomes invalid if it is not used within the specified expiration duration. You can use expires = current time + 30 seconds for authentication. You can specify a margin of 10 to 30 seconds for expiration.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Signature</strong>: Signature is a combination of the access ID, secret key, and expiration parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.</div></li><li class="slate-li " ><div style="position:relative">Create a StringToSign value using the <code class="slate-code">StringToSign = access_id + \n + expires</code> formula.</div></li><li class="slate-li " ><div style="position:relative">Create a Signature value using the <code class="slate-code">Signature = Base64(HMAC-SHA1UTF-8-Encoding-Of(secret_key), UTF-8-Encoding-Of(StringToSign))</code> formula.</div></li></ul><p class="slate-p " >The following Python code is a sample to generate a signature for endpoint authentication:</p><div class="code-block-wrapper"  style="width:100%;min-width:100%" ><div class="code-block-header">Python</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-python keep-markup drop-tokens"><div class="slate-code_line"> def generate_signature(access_id, secret_key):     expires = int(time.time() + 30) # expires in 30 seconds     to_sign = &apos;{}\n{}&apos;.format(access_id, expires)     signature = base64.b64encode(        hmac.new(            secret_key.encode(&apos;utf-8&apos;),            to_sign.encode(&apos;utf-8&apos;),            hashlib.sha1        ).digest()).decode()     return expires, signature   #Example: #access_id = &quot;7e4e6a9c-11ca-****-95af-ed**017358d0&quot; #secret_key = &quot;e61e92fb-****-4cef-9b21-6f1e8211b77b&quot; #Generate signature: #expires, signature = generate_signature(access_id, secret_key) 
</div></code></pre></div><p class="slate-p " ></p>

Users with access to Cyware Orchestrate’s Open APIs module can generate the credentials for API authentication.

You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see 

After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:

The following Python code is a sample to generate a signature for endpoint authentication:

Users with access to Cyware Orchestrate’s Open APIs module can generate the credentials for API authentication. Generate Open API Credentials You can…

<p class="slate-p " >Cyware Orchestrate offers a robust App Store with a comprehensive library of apps required to integrate, orchestrate, and respond using various security tools within your organization. These integrations support tasks such as threat data collection, prioritization, and other analytics, enabling a holistic approach to orchestration from a unified platform.</p><p class="slate-p " >For more information, see <a href="https://techdocs.cyware.com/en/896713-923157-apps.html" target="_self">Integrations</a>.</p><p class="slate-p " >You can perform the following action in this module:</p><p class="slate-p " ><strong class="slate-bold">Retrieve Apps:</strong> Fetch the list of apps installed in the Orchestrate platform.</p><p class="slate-p " ></p>

Cyware Orchestrate offers a robust App Store with a comprehensive library of apps required to integrate, orchestrate, and respond using various security tools within your organization. These integrations support tasks such as threat data collection, prioritization, and other analytics, enabling a holistic approach to orchestration from a unified platform.

You can perform the following action in this module:

 Fetch the list of apps installed in the Orchestrate platform.

Cyware Orchestrate offers a robust App Store with a comprehensive library of apps required to integrate, orchestrate, and respond using various…

<p class="slate-p " >Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization’s specific needs.</p><p class="slate-p " >Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/playbooks.html" target="_self">Playbooks</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbooks and Details</strong>: Fetch the list of playbooks and specific playbook details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Logs and Run Details</strong>: Fetch the list of playbook results and specific run log details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Execute and Manage Playbooks</strong>: Run or terminate specific playbooks.</div></li></ul>

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization’s specific needs.

Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see 

You can perform the following actions in this module:

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for…

<p class="slate-p " ></p><p class="slate-p " >These endpoints provide read access to the custom email templates configured in your workspace. Use them to list all templates or retrieve the HTML body of a specific template.</p>

These endpoints provide read access to the custom email templates configured in your workspace. Use them to list all templates or retrieve the HTML body of a specific template.

<p class="slate-p " ></p><p class="slate-p " >These endpoints provide read access to the code snippets stored in your workspace. Use them to list all snippets or retrieve the source code of a specific snippet.</p>

These endpoints provide read access to the code snippets stored in your workspace. Use them to list all snippets or retrieve the source code of a specific snippet.

<p class="slate-p " ></p><p class="slate-p " >Persistent lists are key-value stores that retain data across playbook executions. Use these endpoints to create, retrieve, update, and delete persistent lists, and to query which playbooks reference a specific list.</p>

Persistent lists are key-value stores that retain data across playbook executions. Use these endpoints to create, retrieve, update, and delete persistent lists, and to query which playbooks reference a specific list.

<p class="slate-p " ><span class="slate-color" style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see</span> <a href="https://techdocs.cyware.com/conextgen/en/analytics-dashboard.html" target="_self">Analytics Dashboard</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Most Used Apps</strong>: Get insights into the most used apps.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Event Processing Metrics</strong>: Get insights on event count, unprocessed events, events with errors, and incoming source events.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Count</strong>: Get insights on playbook run count.</div></li></ul>

The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see

The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer…

<p class="slate-p " >A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/labels,-triggers,-and-events.html##" target="_self">Events</a>.</p><p class="slate-p " >When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create Events</strong>: Create new events with either detailed or concise response data.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Events and Details</strong>: Fetch a list of all events and retrieve the details of a specific event.</div></li></ul><p class="slate-p " ></p>

A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see 

When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.

A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on…

<p class="slate-p " >Creates an event by passing the app identifier, action identifier, and data through the payload.</p>

title

The app identifier associated with the event.

app_identifier

The action identifier associated with the event.

action_identifier

extra_data

data

The Open API access ID generated in the Orchestrate application.

AccessID

HMAC-SHA1 signature generated using the access ID, secret key, and expiry timestamp. Encoded in Base64.

Signature

Unix timestamp (seconds) indicating when the signature expires. Use current time + 30 seconds.

Expires

Returns the dynamically generated unique ID of the event.

<p class="slate-p " >Returns the list of events.</p>

title / app_identifier / action_identifier / readable id based search

unique_id

page

page_size

labels

created less than equal to unix timestamp

create__lte

created greater than equal to unix timestamp

created__gte

created in 
ex : last_week / last_month / last_year

created

Returns the filters applied to the next page.

results

total

<p class="slate-p " >Returns the details of a specific event.</p>

event_unique_id

Returns type of the event associated with the event.

actionid

appid

Returns the event creation timestamp in EPOCH format.

Returns the unique ID of the user who created the event.

createdby

Indicates if the event execution error occurred or not.

execerr

Returns the list of labels associated with the event.

Returns if the event is processed or not.

procd

Returns the source through which the event was triggered. For example, webhook

Returns the ID of the tenant where the event is created.

tenantid

Returns the ID of the workspace where the event is created.

workspaceid

<p class="slate-p " >Creates a new webhook trigger configuration by mapping an app identifier and action identifier to a playbook trigger.</p><p class="slate-p " ></p>

The app identifier to map to the trigger.

The action identifier to map to the trigger.

<p class="slate-p " >Returns a token that can be used to download the raw data payload associated with a specific event.</p>

Column name for which file will be generated

field

A pre-signed URL to download the raw event data file.

file_url

<p class="slate-p " ></p><p class="slate-p " >These endpoints provide read access to the tags defined in your Orchestrate workspace. Use them to list all tags or retrieve the details of a specific tag.</p><p class="slate-p " ></p>

These endpoints provide read access to the tags defined in your Orchestrate workspace. Use them to list all tags or retrieve the details of a specific tag.

Sections