Cyware

Orchestrate Next Gen API Reference

Authentication

Test Connectivity

Playbooks

Get Playbook List

Get Playbook Details

Get Playbook Result

Get Playbook Run Log Details

Bulk Terminate Playbook Result

Run Playbook

Analytics

Get Playbook Run Count

Get Event Count

Get Unprocessed Events

Get Events with Errors

Get Most Used App Actions

Events

Get Events

Get Event Details

Create Event

Webhooks

Create Event with Payload

Default

Production

Sandbox

<p class="slate-p " >Orchestrate Next Gen enables security analysts to collect threat data from multiple sources and automate responses to threats and vulnerabilities using advanced workflows. Analysts can leverage AI for playbook generation, code generation, and debugging run logs, resulting in faster detection, deeper analysis, and more efficient management of the security operations lifecycle. For more details, see <a href="https://techdocs.cyware.com/conextgen/en/index-en.html?contextId=conextgen_landing" target="_blank">Orchestrate Next Gen Product Documentation</a>.</p><p class="slate-p " >The Orchestrate Next Gen open APIs enable you to interact with Orchestrate services, facilitating automation and integration with other systems within your environment.</p><div class="card-box" style="width:60%;"><svg width="32" height="32" viewBox="0 0 24 24" fill="none" class="icon-style" xmlns="http://www.w3.org/2000/svg"> <g clipPath="url(#clip0_2631_5104)"> <path d="M17 0C16.7348 0 16.4804 0.105357 16.2929 0.292893C16.1054 0.48043 16 0.734784 16 1C16 3.949 13.417 5 11 5H4C2.93913 5 1.92172 5.42143 1.17157 6.17157C0.421427 6.92172 0 7.93913 0 9L0 11C0.00218416 11.5987 0.139462 12.1893 0.401603 12.7276C0.663743 13.2659 1.04399 13.7381 1.514 14.109L5.086 22.081C5.34004 22.6521 5.75417 23.1373 6.27827 23.4779C6.80237 23.8185 7.41396 23.9998 8.039 24C8.53631 23.9997 9.02565 23.875 9.46247 23.6373C9.89929 23.3996 10.2697 23.0564 10.54 22.639C10.8104 22.2215 10.972 21.7431 11.0103 21.2473C11.0485 20.7515 10.9621 20.2539 10.759 19.8L8.559 15H11C13.417 15 16 16.051 16 19C16 19.2652 16.1054 19.5196 16.2929 19.7071C16.4804 19.8946 16.7348 20 17 20C17.2652 20 17.5196 19.8946 17.7071 19.7071C17.8946 19.5196 18 19.2652 18 19V1C18 0.734784 17.8946 0.48043 17.7071 0.292893C17.5196 0.105357 17.2652 0 17 0V0ZM8.937 20.619C9.00324 20.7686 9.03109 20.9323 9.01804 21.0954C9.005 21.2585 8.95145 21.4157 8.86227 21.5529C8.77309 21.69 8.65109 21.8027 8.50733 21.8808C8.36357 21.9589 8.20259 21.9999 8.039 22C7.8004 21.9998 7.56697 21.9304 7.36709 21.8001C7.1672 21.6698 7.00945 21.4842 6.913 21.266L4.105 15H6.359L8.937 20.619ZM16 14.6C14.5713 13.4992 12.8024 12.9331 11 13H4C3.46957 13 2.96086 12.7893 2.58579 12.4142C2.21071 12.0391 2 11.5304 2 11V9C2 8.46957 2.21071 7.96086 2.58579 7.58579C2.96086 7.21071 3.46957 7 4 7H11C12.8018 7.0683 14.5706 6.50403 16 5.405V14.6ZM23.9 15.452C23.8413 15.5696 23.7601 15.6744 23.6609 15.7606C23.5617 15.8467 23.4465 15.9125 23.3218 15.9541C23.1972 15.9957 23.0656 16.0123 22.9345 16.0031C22.8035 15.9938 22.6755 15.9588 22.558 15.9L20.558 14.9C20.3206 14.7814 20.1401 14.5735 20.0561 14.3218C19.972 14.0701 19.9915 13.7954 20.11 13.558C20.2286 13.3206 20.4365 13.1401 20.6882 13.0561C20.9399 12.972 21.2146 12.9914 21.452 13.11L23.452 14.11C23.6882 14.2285 23.8678 14.4356 23.9518 14.6861C24.0357 14.9366 24.0171 15.2102 23.9 15.447V15.452ZM20.11 6.452C20.0512 6.33448 20.0162 6.20653 20.0069 6.07546C19.9977 5.9444 20.0143 5.81279 20.0559 5.68816C20.0975 5.56353 20.1633 5.44832 20.2494 5.34912C20.3356 5.24991 20.4404 5.16866 20.558 5.11L22.558 4.11C22.7954 3.99145 23.0701 3.97205 23.3218 4.05606C23.5735 4.14008 23.7815 4.32063 23.9 4.558C24.0186 4.79537 24.038 5.07011 23.9539 5.32178C23.8699 5.57346 23.6894 5.78145 23.452 5.9L21.452 6.9C21.3345 6.95876 21.2065 6.99378 21.0755 7.00306C20.9444 7.01234 20.8128 6.99571 20.6882 6.9541C20.5635 6.9125 20.4483 6.84674 20.3491 6.76058C20.2499 6.67443 20.1687 6.56957 20.11 6.452ZM20 10C20 9.73478 20.1054 9.48043 20.2929 9.29289C20.4804 9.10536 20.7348 9 21 9H23C23.2652 9 23.5196 9.10536 23.7071 9.29289C23.8946 9.48043 24 9.73478 24 10C24 10.2652 23.8946 10.5196 23.7071 10.7071C23.5196 10.8946 23.2652 11 23 11H21C20.7348 11 20.4804 10.8946 20.2929 10.7071C20.1054 10.5196 20 10.2652 20 10Z" fill="#374957"/> </g> <defs> <clipPath id="clip0_2631_5104"> <rect width="32" height="32" fill="white"/> </clipPath> </defs> </svg><div ><p class="slate-p " ><strong class="slate-bold">Supported Orchestrate Next Gen Version</strong>: 3.12.0 and later versions.</p></div></div><p class="slate-p " >The API reference includes public Orchestrate API endpoints for the following modules:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><a href="68e8d6433185cf4ee8963e7c" target="">Playbooks</a></div></li><li class="slate-li " ><div style="position:relative"><a href="68e8d6433185cf4ee8963ede" target="">Analytics</a></div></li></ul><div style="width:100%;
	min-width:100%;" class="callout-widget" data-type=info ><div class="callout-icon"><svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M10.0628 14.1676C10.2434 14.1676 10.3927 14.1086 10.5107 13.9905C10.6288 13.8725 10.6878 13.7232 10.6878 13.5426V9.77177C10.6878 9.6051 10.6253 9.46274 10.5003 9.34469C10.3753 9.22663 10.2295 9.1676 10.0628 9.1676C9.88227 9.1676 9.73296 9.22663 9.61491 9.34469C9.49685 9.46274 9.43783 9.61205 9.43783 9.7926V13.5634C9.43783 13.7301 9.50033 13.8725 9.62533 13.9905C9.75033 14.1086 9.89616 14.1676 10.0628 14.1676ZM10.0003 7.62594C10.1948 7.62594 10.358 7.56344 10.4899 7.43844C10.6219 7.31344 10.6878 7.15371 10.6878 6.95927C10.6878 6.76482 10.6219 6.59816 10.4899 6.45927C10.358 6.32038 10.1948 6.25094 10.0003 6.25094C9.80588 6.25094 9.64269 6.32038 9.51074 6.45927C9.3788 6.59816 9.31283 6.76482 9.31283 6.95927C9.31283 7.15371 9.3788 7.31344 9.51074 7.43844C9.64269 7.56344 9.80588 7.62594 10.0003 7.62594ZM10.0003 18.3343C8.81977 18.3343 7.72255 18.1225 6.70866 17.6989C5.69477 17.2752 4.81283 16.6884 4.06283 15.9384C3.31283 15.1884 2.72602 14.3065 2.30241 13.2926C1.8788 12.2787 1.66699 11.1815 1.66699 10.0009C1.66699 8.83427 1.8788 7.74399 2.30241 6.7301C2.72602 5.71621 3.31283 4.83427 4.06283 4.08427C4.81283 3.33427 5.69477 2.74399 6.70866 2.31344C7.72255 1.88288 8.81977 1.6676 10.0003 1.6676C11.167 1.6676 12.2573 1.88288 13.2712 2.31344C14.285 2.74399 15.167 3.33427 15.917 4.08427C16.667 4.83427 17.2573 5.71621 17.6878 6.7301C18.1184 7.74399 18.3337 8.83427 18.3337 10.0009C18.3337 11.1815 18.1184 12.2787 17.6878 13.2926C17.2573 14.3065 16.667 15.1884 15.917 15.9384C15.167 16.6884 14.285 17.2752 13.2712 17.6989C12.2573 18.1225 11.167 18.3343 10.0003 18.3343ZM10.0003 17.0843C11.9448 17.0843 13.6114 16.3898 15.0003 15.0009C16.3892 13.612 17.0837 11.9454 17.0837 10.0009C17.0837 8.05649 16.3892 6.38982 15.0003 5.00094C13.6114 3.61205 11.9448 2.9176 10.0003 2.9176C8.05588 2.9176 6.38921 3.61205 5.00033 5.00094C3.61144 6.38982 2.91699 8.05649 2.91699 10.0009C2.91699 11.9454 3.61144 13.612 5.00033 15.0009C6.38921 16.3898 8.05588 17.0843 10.0003 17.0843Z" fill="#3960B4"></path></svg></div><div ><p class="slate-p " ><span style="background-color:rgb(248, 248, 248);color:rgb(29, 28, 29)">This documentation currently includes a limited set of API endpoints. Additional endpoints are in progress and will be published iteratively.</span></p></div></div><p class="slate-p " ></p><p class="slate-p " ></p><p class="slate-p " ></p><p class="slate-p " ></p>

Orchestrate Next Gen enables security analysts to collect threat data from multiple sources and automate responses to threats and vulnerabilities using advanced workflows. Analysts can leverage AI for playbook generation, code generation, and debugging run logs, resulting in faster detection, deeper analysis, and more efficient management of the security operations lifecycle. For more details, see 

The Orchestrate Next Gen open APIs enable you to interact with Orchestrate services, facilitating automation and integration with other systems within your environment.

The API reference includes public Orchestrate API endpoints for the following modules:

<p class="slate-p " >Users with access to Cyware Orchestrate&apos;s Open APIs module can generate the credentials for API authentication.</p><h2 class="slate-h2 " >Generate Open API Credentials</h2><p class="slate-p " >You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see <a href="https://techdocs.cyware.com/conextgen/en/configure-open-api.html" target="_blank">Configure Open API</a>.</p><h3 class="slate-h3 " >Mandatory Query Parameters for Requests</h3><p class="slate-p " >After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Access ID</strong>: Indicates the access ID linked to your Orchestrate Open API. For example, 57d008xx-7xxx-xx-b27a-1feb943d0xxx.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Expires</strong>: Indicates the validity of the signature parameter. The signature becomes invalid if it is not used within the specified expiration duration. You can use expires = current time + 30 seconds for authentication. You can specify a margin of 10 to 30 seconds for expiration.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Signature</strong>: Signature is a combination of the access ID, secret key, and expiration parameters to authenticate API requests. The signature is hashed using the HMAC-SHA1 algorithm and then encoded using the Base64 scheme.</div><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative">Create a StringToSign value using the <code class="slate-code">StringToSign = access_id + \n + expires</code><em class="slate-italic"> </em>formula.</div></li><li class="slate-li " ><div style="position:relative">Create a Signature value using the <code class="slate-code">Signature = Base64(HMAC-SHA1UTF-8-Encoding-Of(secret_key), UTF-8-Encoding-Of(StringToSign))</code> formula.</div></li></ul></li></ul><p class="slate-p " >The following Python code is a sample to generate a signature for endpoint authentication:</p><div class="code-block-wrapper"  style="width:60%" ><div class="code-block-header">Python</div><pre class="slate-CodeBlockElement slate-code_block"><textarea id="publishedPageCodeblock" style="display:none !important; visibility: hidden; opacity: 0; width: 1px; height: 1px;" type="hidden"> </textarea><code class="language-python keep-markup drop-tokens"><div class="slate-code_line"><div class="slate-code_line">def generate_signature(access_id, secret_key):
    expires = int(time.time() + 30) # expires in 30 seconds
    to_sign = &apos;{}\n{}&apos;.format(access_id, expires)
    signature = base64.b64encode(
       hmac.new(
           secret_key.encode(&apos;utf-8&apos;),
           to_sign.encode(&apos;utf-8&apos;),
           hashlib.sha1
       ).digest()).decode()
    return expires, signature


#Example:
#access_id = &quot;7e4e6a9c-11ca-****-95af-ed**017358d0&quot;
#secret_key = &quot;e61e92fb-****-4cef-9b21-6f1e8211b77b&quot;
#Generate signature:
#expires, signature = generate_signature(access_id, secret_key)</div></div></code></pre></div><p class="slate-p " ></p><p class="slate-p " ></p>

Users with access to Cyware Orchestrate's Open APIs module can generate the credentials for API authentication.

You can generate open API credentials in the Orchestrate application to access the open API endpoints. For more information on how to generate Open API credentials in Orchestrate, see 

After you have generated open API credentials, use them to authenticate your API requests. Ensure the following parameters are included in the query of each request:

The following Python code is a sample to generate a signature for endpoint authentication:

<p class="slate-p " >Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization&apos;s specific needs.</p><p class="slate-p " >Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/playbooks.html" target="_blank">Playbooks</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbooks and Details</strong>: Fetch the list of playbooks and specific playbook details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Logs and Run Details</strong>: Fetch the list of playbook results and specific run log details.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Execute and Manage Playbooks</strong>: Run or terminate specific playbooks.</div></li></ul><p class="slate-p " ></p>

Playbooks are a structured sequence of actions organized into workflows to automate and orchestrate security responses, standardizing processes for effective incident and threat management. Orchestrate offers manual and automated playbooks to meet your organization's specific needs.

Playbooks can be scheduled based on application input sources or automatically triggered by specific events. Additionally, playbooks facilitate seamless integration between different security tools, creating a more connected and efficient security environment. For more information, see 

You can perform the following actions in this module:

<p class="slate-p " ><span style="background-color:rgb(255, 255, 255);color:rgb(0, 0, 0)">The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see </span><a href="https://techdocs.cyware.com/conextgen/en/analytics-dashboard.html" target="_blank">Analytics Dashboard</a>.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Most Used Apps</strong>: Get insights into the most used apps.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Event Processing Metrics</strong>: Get insights on event count, unprocessed events, events with errors, and incoming source events.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Playbook Run Count</strong>: Get insights on playbook run count.</div></li></ul><p class="slate-p " ></p><p class="slate-p " ></p>

The Analytics Dashboard in Orchestrate provides an overview of activities across modules. Upon signing in, users can view dashboards that offer insights into playbook workflows, app performance, instance usage, and action execution. By analyzing key metrics such as frequently used playbooks and actions, analysts can optimize workflows and enhance automation. Dashboards also help identify underutilized events, diagnose execution errors, and refine automated responses, reducing manual intervention. For more information, see 

<p class="slate-p " >A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/labels,-triggers,-and-events.html##" target="_blank">Events</a>.</p><p class="slate-p " >When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.</p><p class="slate-p " >You can perform the following actions in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create Events</strong>: Create new events with either detailed or concise response data.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Retrieve Events and Details</strong>: Fetch a list of all events and retrieve the details of a specific event.</div></li></ul><p class="slate-p " ></p>

A Source Event acts as a trigger for a playbook to execute. You can configure triggers to automatically trigger the execution of a playbook based on the occurrence of an event. These events can occur in Orchestrate or on external platforms such as Respond, Intel Exchange, Splunk, and more. You can configure the source event app and source event type to execute pre-configured playbook workflows. For more information, see 

When a Source Event is triggered in Cyware Orchestrate, it carries the Source Event Data from integrated tools like Splunk, Respond, and other apps. This data is transmitted in JSON format via the Cyware Orchestrate REST API.

<p class="slate-p " >Webhooks are serialized messages/information sent from one application to another&apos;s unique URL over the web. Webhooks enable analysts to bypass data exchange complications by generating token-based URLs and authenticating endpoints whenever events (GET and POST requests) are triggered in the Orchestrate application.</p><p class="slate-p " ><strong class="slate-bold">Webhooks</strong> module allows users to create and manage webhook configurations and tokens. Users will be able to access features based on the permissions assigned to the user in the Orchestrate application. For more information, see <a href="https://techdocs.cyware.com/conextgen/en/configure-webhooks.html" target="_blank">Configure Webhooks</a>.</p><h2 class="slate-h2 " >Authentication</h2><h4 class="slate-h4 " >Generate Webhook Credentials</h4><ol class="slate-ol " ><li class="slate-li " ><div style="position:relative">Navigate to the <strong class="slate-bold">Admin Panel</strong> and select <strong class="slate-bold">Webhooks</strong>.</div></li><li class="slate-li " ><div style="position:relative">Click <strong class="slate-bold">Add Webhook</strong> and enter the webhook details.</div></li><li class="slate-li " ><div style="position:relative">After entering the details, click <strong class="slate-bold">Generate Webhook URL</strong>.</div></li><li class="slate-li " ><div style="position:relative">After the webhook URL is generated, copy the <strong class="slate-bold">token </strong>from the URL.</div></li></ol><p class="slate-p " >You can perform the following action in this module:</p><ul class="slate-ul " ><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create Events through Payload</strong>: Create new events by passing the app identifier, action identifier, and data through the payload.</div></li><li class="slate-li " ><div style="position:relative"><strong class="slate-bold">Create Event</strong>: Create an event by passing the app identifier and action identifier through the URL</div></li></ul><p class="slate-p " ></p>

Webhooks are serialized messages/information sent from one application to another's unique URL over the web. Webhooks enable analysts to bypass data exchange complications by generating token-based URLs and authenticating endpoints whenever events (GET and POST requests) are triggered in the Orchestrate application.

 module allows users to create and manage webhook configurations and tokens. Users will be able to access features based on the permissions assigned to the user in the Orchestrate application. For more information, see 

You can perform the following action in this module:

<p class="slate-p " >Creates an event by passing the app identifier, action identifier, and data through the payload.</p>

Creates an event by passing the app identifier, action identifier, and data through the payload.

appid

Pass the type of the event. For example, phishing

actionid

Pass the labels you want to add to the event.

labels

Pass the data to include with the event in JSON format.

data

title

Pass the webhooks authentication token generated in Cyware Orchestrate.

token

Returns the dynamically generated unique ID of the event.

<p class="slate-p " >Creates an event by passing the app identifier and action identifier through the URL and data through the payload.</p>

Creates an event by passing the app identifier and action identifier through the URL and data through the payload.

Pass the data as key-value pairs with the event.

Pass the event type to create an event. For example, phishing

Returns the unique ID generated dynamically for the event.

Sections