Cyware

Orchestrate Next Gen API Reference

Authentication

Test Connectivity

Playbooks

Get Playbook List

Get Playbook Details

Get Playbook Result

Get Playbook Run Log Details

Bulk Terminate Playbook Result

Run Playbook

Analytics

Get Playbook Run Count

Get Event Count

Get Unprocessed Events

Get Events with Errors

Get Most Used App Actions

Default

Production

Sandbox

<p class="slate-p " >Orchestrate Next Gen enables security analysts to collect threat data from multiple sources and automate responses to threats and vulnerabilities using advanced workflows. Analysts can leverage AI for playbook generation, code generation, and debugging run logs, resulting in faster detection, deeper analysis, and more efficient management of the security operations lifecycle. For more details, see <a href="https://techdocs.cyware.com/conextgen/en/index-en.html?contextId=conextgen_landing" target="_blank">Orchestrate Next Gen Product Documentation</a>.</p><p class="slate-p " >The Orchestrate Next Gen open APIs enable you to interact with Orchestrate services, facilitating automation and integration with other systems within your environment.</p><div class="card-box" style="width:60%;"><svg width="32" height="32" viewBox="0 0 24 24" fill="none" class="icon-style" xmlns="http://www.w3.org/2000/svg"> <g clipPath="url(#clip0_2631_5104)"> <path d="M17 0C16.7348 0 16.4804 0.105357 16.2929 0.292893C16.1054 0.48043 16 0.734784 16 1C16 3.949 13.417 5 11 5H4C2.93913 5 1.92172 5.42143 1.17157 6.17157C0.421427 6.92172 0 7.93913 0 9L0 11C0.00218416 11.5987 0.139462 12.1893 0.401603 12.7276C0.663743 13.2659 1.04399 13.7381 1.514 14.109L5.086 22.081C5.34004 22.6521 5.75417 23.1373 6.27827 23.4779C6.80237 23.8185 7.41396 23.9998 8.039 24C8.53631 23.9997 9.02565 23.875 9.46247 23.6373C9.89929 23.3996 10.2697 23.0564 10.54 22.639C10.8104 22.2215 10.972 21.7431 11.0103 21.2473C11.0485 20.7515 10.9621 20.2539 10.759 19.8L8.559 15H11C13.417 15 16 16.051 16 19C16 19.2652 16.1054 19.5196 16.2929 19.7071C16.4804 19.8946 16.7348 20 17 20C17.2652 20 17.5196 19.8946 17.7071 19.7071C17.8946 19.5196 18 19.2652 18 19V1C18 0.734784 17.8946 0.48043 17.7071 0.292893C17.5196 0.105357 17.2652 0 17 0V0ZM8.937 20.619C9.00324 20.7686 9.03109 20.9323 9.01804 21.0954C9.005 21.2585 8.95145 21.4157 8.86227 21.5529C8.77309 21.69 8.65109 21.8027 8.50733 21.8808C8.36357 21.9589 8.20259 21.9999 8.039 22C7.8004 21.9998 7.56697 21.9304 7.36709 21.8001C7.1672 21.6698 7.00945 21.4842 6.913 21.266L4.105 15H6.359L8.937 20.619ZM16 14.6C14.5713 13.4992 12.8024 12.9331 11 13H4C3.46957 13 2.96086 12.7893 2.58579 12.4142C2.21071 12.0391 2 11.5304 2 11V9C2 8.46957 2.21071 7.96086 2.58579 7.58579C2.96086 7.21071 3.46957 7 4 7H11C12.8018 7.0683 14.5706 6.50403 16 5.405V14.6ZM23.9 15.452C23.8413 15.5696 23.7601 15.6744 23.6609 15.7606C23.5617 15.8467 23.4465 15.9125 23.3218 15.9541C23.1972 15.9957 23.0656 16.0123 22.9345 16.0031C22.8035 15.9938 22.6755 15.9588 22.558 15.9L20.558 14.9C20.3206 14.7814 20.1401 14.5735 20.0561 14.3218C19.972 14.0701 19.9915 13.7954 20.11 13.558C20.2286 13.3206 20.4365 13.1401 20.6882 13.0561C20.9399 12.972 21.2146 12.9914 21.452 13.11L23.452 14.11C23.6882 14.2285 23.8678 14.4356 23.9518 14.6861C24.0357 14.9366 24.0171 15.2102 23.9 15.447V15.452ZM20.11 6.452C20.0512 6.33448 20.0162 6.20653 20.0069 6.07546C19.9977 5.9444 20.0143 5.81279 20.0559 5.68816C20.0975 5.56353 20.1633 5.44832 20.2494 5.34912C20.3356 5.24991 20.4404 5.16866 20.558 5.11L22.558 4.11C22.7954 3.99145 23.0701 3.97205 23.3218 4.05606C23.5735 4.14008 23.7815 4.32063 23.9 4.558C24.0186 4.79537 24.038 5.07011 23.9539 5.32178C23.8699 5.57346 23.6894 5.78145 23.452 5.9L21.452 6.9C21.3345 6.95876 21.2065 6.99378 21.0755 7.00306C20.9444 7.01234 20.8128 6.99571 20.6882 6.9541C20.5635 6.9125 20.4483 6.84674 20.3491 6.76058C20.2499 6.67443 20.1687 6.56957 20.11 6.452ZM20 10C20 9.73478 20.1054 9.48043 20.2929 9.29289C20.4804 9.10536 20.7348 9 21 9H23C23.2652 9 23.5196 9.10536 23.7071 9.29289C23.8946 9.48043 24 9.73478 24 10C24 10.2652 23.8946 10.5196 23.7071 10.7071C23.5196 10.8946 23.2652 11 23 11H21C20.7348 11 20.4804 10.8946 20.2929 10.7071C20.1054 10.5196 20 10.2652 20 10Z" fill="#374957"/> </g> <defs> <clipPath id="clip0_2631_5104"> <rect width="32" height="32" fill="white"/> </clipPath> </defs> </svg><div ><p class="slate-p " ><strong class="slate-bold">Supported Orchestrate Next Gen Version</strong>: 3.12.0 and later versions.</p></div></div><p class="slate-p " >The API reference includes public Orchestrate API endpoints for the following modules:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><a href="68e8d6433185cf4ee8963e7c" target="">Playbooks</a></div></li><li class="slate-li " ><div style="position:relative"><a href="68e8d6433185cf4ee8963ede" target="">Analytics</a></div></li></ul><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " ><span style="background-color:rgb(248, 248, 248);color:rgb(29, 28, 29)">This documentation currently includes a limited set of API endpoints. Additional endpoints are in progress and will be published iteratively.</span></p></div></div><p class="slate-p " ></p><p class="slate-p " ></p><p class="slate-p " ></p><p class="slate-p " ></p>

Orchestrate Next Gen enables security analysts to collect threat data from multiple sources and automate responses to threats and vulnerabilities using advanced workflows. Analysts can leverage AI for playbook generation, code generation, and debugging run logs, resulting in faster detection, deeper analysis, and more efficient management of the security operations lifecycle. For more details, see 

The Orchestrate Next Gen open APIs enable you to interact with Orchestrate services, facilitating automation and integration with other systems within your environment.

The API reference includes public Orchestrate API endpoints for the following modules:

<p class="slate-p " >Users with access to Cyware Orchestrate&apos;s Open APIs module can generate the credentials for API authentication.</p><h2 class="slate-h2 " >Generate Open API Credentials</h2><p class="slate-p " >You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see <a href="https://techdocs.cyware.com/conextgen/en/configure-open-api.html" target="_blank">Configure Open API</a>.</p><h3 class="slate-h3 " >Mandatory Query Parameters for Requests</h3><p class="slate-p " >After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access ID</strong>: Indicates the access ID linked to your Orchestrate Open API. For example, 57d008xx-7xxx-xx-b27a-1feb943d0xxx.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Expires</strong>: Indicates the validity of the signature parameter. The signature becomes invalid if it is not used within the specified expiration duration. You can use expires = current time + 30 seconds for authentication. You can specify a margin of 10 to 30 seconds for expiration.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Signature</strong>: Signature is a combination of the access ID, secret key, and expiration parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.</div><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative">Create a StringToSign value using the <code class="slate-code">StringToSign = access_id + \n + expires</code><em class="slate-italic"> </em>formula.</div></li><li class="slate-li " ><div style="position:relative">Create a Signature value using the <code class="slate-code">Signature = Base64(HMAC-SHA1UTF-8-Encoding-Of(secret_key), UTF-8-Encoding-Of(StringToSign))</code> formula.</div></li></ul></li></ul><p class="slate-p " >The following Python code is a sample to generate a signature for endpoint authentication:</p><div class="code-block-wrapper"  style="width:100%;min-width:100%" ><div class="code-block-header">Python</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-python keep-markup drop-tokens"><div class="slate-code_line"><div class="slate-code_line">def generate_signature(access_id, secret_key):
    expires = int(time.time() + 30) # expires in 30 seconds
    to_sign = &apos;{}\n{}&apos;.format(access_id, expires)
    signature = base64.b64encode(
       hmac.new(
           secret_key.encode(&apos;utf-8&apos;),
           to_sign.encode(&apos;utf-8&apos;),
           hashlib.sha1
       ).digest()).decode()
    return expires, signature


#Example:
#access_id = &quot;7e4e6a9c-11ca-****-95af-ed**017358d0&quot;
#secret_key = &quot;e61e92fb-****-4cef-9b21-6f1e8211b77b&quot;
#Generate signature:
#expires, signature = generate_signature(access_id, secret_key)</div></div></code></pre></div><p class="slate-p " ></p><p class="slate-p " ></p>

Users with access to Cyware Orchestrate's Open APIs module can generate the credentials for API authentication.

You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see 

After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:

The following Python code is a sample to generate a signature for endpoint authentication:

<p class="slate-p " >Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization&apos;s specific needs.</p><p class="slate-p " >Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/playbooks.html" target="_blank">Playbooks</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbooks and Details</strong>: Fetch the list of playbooks and specific playbook details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Logs and Run Details</strong>: Fetch the list of playbook results and specific run log details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Execute and Manage Playbooks</strong>: Run or terminate specific playbooks.</div></li></ul><p class="slate-p " ></p>

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization's specific needs.

Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see 

You can perform the following actions in this module:

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">Returns a list of active playbooks in Orchestrate.</span></p><p class="slate-p " ></p>

Returns a list of active playbooks in Orchestrate.

sort

Pass the status value to retrieve playbooks.

status

Pass the page number to retrieve the playbook list.



page

Pass the number of items to retrieve per page.

page_size

Pass the start time to retrieve playbooks based on their last modification time.

modified__gte

Pass the end time to retrieve playbooks based on their last modification time.


modified__lte

Pass 1 to retrieve scheduled playbooks, else 0.



scheduled

Pass true to retrieve the playbooks that are followed for updates.

is_followed

Pass the user ID to retrieve the playbooks created by that user.

createdby__in

Pass the user ID to retrieve the playbooks that were last modified by that user.

modifiedby__in

Pass label IDs to retrieve playbooks associated with it.

labels__has

Pass app IDs to retrieve playbooks that include the specified apps.

appidlist__has

Pass action IDs to retrieve playbooks that include the specified actions.

actionlist__has

Pass tag IDs to retrieve the playbooks associated with them.

tags__has

Returns the filters applied to the current page.

results

total

<p class="slate-p " >Returns playbook details based on the playbook ID passed. If no ID is passed, it returns the complete list of both user-created and system playbooks.</p>

Returns playbook details based on the playbook ID passed. If no ID is passed, it returns the complete list of both user-created and system playbooks.

Pass the unique ID of a playbook to retrieve details of a specific playbook. You can retrieve unique IDs of playbook using the **Get Playbooks List** endpoint.

Returns the list of IDs of the actions used in the playbook.

actionlist

Returns the list of app slug added to the playbook.

appidlist

Retrieves the app hash values of all apps included in the playbook.

applist

Returns the interval configured to wait for the playbook to complete before it is automatically terminated.

auto_terminate_interval

Returns a list of user IDs following playbook updates.

busers

Returns the categories associated with the playbooks in **Orchestrate** > **Manage Playbooks** > **App Store**.

created

Returns the user ID who created the playbook.

createdby

description

Returns the node connection details, such as destination node, label, and source node.

edges

hash

Returns the details of the instances used in the playbook, where key returns app hash and value returns instance slug.

instancedata

Returns the number of users who follow the playbook for updates.

Returns the list of labels associated with the playbook.

labels

Returns a list of code snippet IDs associated with the playbook.

metadata

Returns the date and time when the playbook was last modified in Epoch nanoseconds format.

modified

Returns the ID of the user who last modified the playbook.

modifiedby

nodes

Returns the output parameters of the playbook execution.



output_params

Returns the slug of the playbook in the playbook store.

pbstoreslug

Returns the persistent list IDs associated with the playbooks.

pllist

readableid

Returns the details of the playbook schedule, such as run time, end time, and more.



schedule_info

Returns the source that triggers the playbook. 

source

Returns the list of subplaybook IDs associated with the playbook.

subpblist

Returns the list of tags associated with the playbook.

tenantid

title

validation_errors

version

versiondata

Returns the workspace ID where the playbooks are created.

workspaceid

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgba(20, 23, 25, 0.72)">Returns the playbook runlogs based on the unique ID of the playbook. If no payload is passed, it returns the complete list of playbook run logs.</span></p>

Returns the playbook runlogs based on the unique ID of the playbook. If no payload is passed, it returns the complete list of playbook run logs.

Pass the playbook's unique ID. You can retrieve unique IDs of playbooks using the Get Playbooks List endoint.


pbresult

Pass the page number to retrieve the playbook result.

Returns the filters applied to the previous page.

Returns the JSON list of playbook run logs.

Returns the total number of run logs associated with the playbook.

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">Returns the run logs details of a specific playbook run.</span></p>

Returns the run logs details of a specific playbook run.

Pass the unique ID generated during the playbook run. 

{pb_result_id}

Returns the time when the playbook was created.

Returns the error that occurred during playbook execution.

error

Returns the total time taken to execute the playbook.

execution_time

Returns the time when the playbook was last modified.

Retrieves the results and details of nodes.

nr_data

pbhash

plb_data

Returns the source that triggered the playbook run.

sourcetype

Returns the details of the source that triggered the playbook run.

sourcevalue

Returns the number of sub-playbooks associated with the playbook.

subplaybookcount

Returns the ID of the tenant where the playbook was created.

Returns the ID of the workspace where the playbook was executed.

workspace

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">Terminate playbook runs in bulk. You can terminate a maximum of 100 playbook runs at a time with the run status in progress, in-queue, waiting, or on hold.</span></p>

Terminate playbook runs in bulk. You can terminate a maximum of 100 playbook runs at a time with the run status in progress, in-queue, waiting, or on hold.

Pass the unique IDs of the playbook runs in a list. You can retrieve the unique IDs of playbook results using the Get Playbook Run Logs endpoint.



Returns the bulk terminate status of the run logs.

There are no response parameters. A successful task execution returns a response with a status code of 200.

<p class="slate-p " >Run a playbook by passing the playbook&apos;s unique ID through the payload.</p><p class="slate-p " ></p>

Run a playbook by passing the playbook's unique ID through the payload.

Pass the data or inputs as key-value pairs to run the playbook.

data

Pass the unique ID of the event to fetch the event data for playbook execution. 

event

input_type

Pass the input that will be pass to the playbook.

input

Pass the hash value of the playbook to execute. You can retrieve the unique ID of a playbook using the **Get Playbooks List** endpoint.

playbook_hash

Returns the unique ID assigned to the playbook result. You can retrieve the detailed playbook run details using the **Get Playbook Run Log** Details endpoint.

result_id

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see </span><a href="https://techdocs.cyware.com/conextgen/en/analytics-dashboard.html" target="_blank">Analytics Dashboard</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Most Used Apps</strong>: Get insights into the most used apps.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Event Processing Metrics</strong>: Get insights on event count, unprocessed events, events with errors, and incoming source events.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Count</strong>: Get insights on playbook run count.</div></li></ul><p class="slate-p " ></p><p class="slate-p " ></p>

The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see 

Sections