API Documentation for Custom Strategies

get/app/api/v1/custom-strategies

List all custom strategies. Use is_protected filter to distinguish between user-created and OOTB strategies.

Authorizations

• ApiKeyAuth

Query Parameters

• alert_sources string[] (Optional): Filter by alert sources
• attack_surfaces string[] (Optional): Filter by attack surfaces
• is_archived boolean (Optional): Filter by archived status
• is_enabled boolean (Optional): Filter by enabled status
• is_protected boolean (Optional): Filter by protected status (true=OOTB, false=user-created)
• mitre_tactics string[] (Optional): Filter by MITRE tactics
• search_query string (Optional): Search in strategy title and scenario

Responses

• 200: List of custom strategies

{
  "alert_sources": [],
  "attack_surfaces": [],
  "created_at": "2026-07-27T03:06:07.976Z",
  "id": 1,
  "instructions": [{
    "content": "text",
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "strategy_versions": [1],
    "usage_count": 1
  }],
  "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
  "is_archived": true,
  "is_enabled": true,
  "is_latest": true,
  "is_protected": true,
  "mitre_tactics": [],
  "outcomes": [{
    "conclusions_affected": 1,
    "condition": {"ANY_ADDITIONAL_PROPERTY": "anything"},
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "outcome": "COMPLETED_BREACHED_CONFIRMED",
    "strategy_versions": [1]
  }],
  "priorities": [{
    "created_at": "2026-07-27T03:06:07.976Z",
    "id": 1,
    "insight_tag_rule": {"ANY_ADDITIONAL_PROPERTY": "anything"},
    "internal_origin_uuid": "123e4567-e89b-12d3-a456-426614174000",
    "outcomes": ["COMPLETED_BREACHED_CONFIRMED"],
    "priorities_affected": 1,
    "priority": "informational",
    "ranking": 1,
    "strategy_versions": [1]
  }],
  "scenario": "text",
  "title": "text",
  "total_conclusions_affected": 1,
  "total_instructions_used": 1,
  "total_priorities_affected": 1,
  "updated_at": "2026-07-27T03:06:07.976Z",
  "version_id": 1
}

post/app/api/v1/custom-strategies

Create a new custom strategy.

Authorizations

• ApiKeyAuth

Body

{
  "alert_sources": [],
  "attack_surfaces": [],
  "instructions": [{}],
  "is_enabled": false,
  "mitre_tactics": [],
  "outcomes": [{}],
  "priorities": [{}],
  "scenario": "text",
  "title": "text"
}

Responses

• 201: Custom strategy created successfully

get/app/api/v1/custom-strategies/{strategy_id}

Get a specific custom strategy by ID. Includes both user-created and OOTB (protected) strategies.

Authorizations

• ApiKeyAuth

Responses

• 200: Custom strategy details

put/app/api/v1/custom-strategies/{strategy_id}

Update a custom strategy (full replacement - creates new version).

Authorizations

• ApiKeyAuth

Body

{
  "alert_sources": [],
  "attack_surfaces": [],
  "instructions": [{}],
  "is_enabled": true,
  "mitre_tactics": [],
  "outcomes": [{}],
  "priorities": [{}],
  "scenario": "text",
  "title": "text"
}

Responses

• 200: Strategy updated successfully

delete/app/api/v1/custom-strategies/{strategy_id}

Delete or archive a custom strategy (archives if referenced by investigations).

Authorizations

• ApiKeyAuth

Responses

• 204: Strategy deleted or archived successfully