Skip to content
TTX-Zone
The API may change between versions while TTX-Zone is 0.x.

Inject catalog

GET
/api/v1/inject-catalog
curl --request GET \
  --url https://example.com/api/v1/inject-catalog \
  --cookie ttx_access_token=<ttx_access_token>

TTX-Zone’s own injects, both languages: read-only, duplicable.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Successful Response

Media typeapplication/json
SystemInjectListResponse

GET /inject-catalog: names resolved from the catalog’s ATT&CK release.

object
attack_version
required
Attack Version
string
items
required
Items
Array<object>
SystemInjectRead
object
actor
required
Actor
string
attachments
required
Attachments
Array<object>
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
attack
required
Attack
Array<object>
CatalogAttackRead
object
domain
required
Domain
string
tactic_id
required
Tactic Id
string
tactic_name
required
Tactic Name
string
technique_id
required
Technique Id
string
technique_name
required
Technique Name
string
audience
required
InjectAudience
string
Allowed values: executive technical mixed
capabilities
required
Capabilities
Array<string>
>= 1 items <= 2 items
Allowed values: detection_triage_escalation incident_classification crisis_decision_making regulatory_notification internal_external_comms cross_unit_coordination third_party_supply_chain continuity_recovery legal_forensics
content
required
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
contingent_for
required
Any of:
string
delivery_method
required
DeliveryMethod
string
Allowed values: email phone chat ticket security_tool in_person briefing media document
expected_actions
required
Expected Actions
Array<object>
>= 1 items <= 8 items
CatalogAction
object
description
required
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
responsible_role
required
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
within_minutes
required
Any of:
integer
> 0
facilitator_notes
required
Any of:
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
families
required
Families
Array<string>
>= 1 items
Allowed values: ransomware data_breach bec_fraud phishing_account_takeover supply_chain cloud_compromise ddos insider wiper_destructive ot_ics physical_hybrid regulatory generic
frameworks
required
Frameworks
Array<string>
id
required
Id
string
images
Images
Array<object>
default:
CatalogImageRead

An illustration of a catalog inject, served at GET /inject-catalog/{id}/images/{index}?lang=; copied into the MSEL with the inject.

object
caption
required
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
height
required
Height
integer
index
required
Index
integer
width
required
Width
integer
key_question
required
Any of:
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
kind
required
InjectKind
string
Allowed values: mandatory contingent
purpose
required
Any of:
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
recipients
required
Recipients
Array<object>
>= 1 items <= 5 items
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
stage
required
InjectStage

Where in the incident an inject sits – the MSEL’s suggested phases.

string
Allowed values: detection escalation response recovery
title
required
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
trigger
required
Any of:
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
variable_defaults
required
Variable Defaults
object
key
additional properties
Localized
object
en
required
En
string
>= 1 characters
es
required
Es
string
>= 1 characters
variables
required
Variables
Array<string>

Example 

{
  "items": [
    {
      "audience": "executive",
      "capabilities": [
        "detection_triage_escalation"
      ],
      "delivery_method": "email",
      "families": [
        "ransomware"
      ],
      "images": [],
      "kind": "mandatory",
      "stage": "detection"
    }
  ]
}