Workflow Templates¶
Workflow Templates are codified procedures for the steps to be taken within a Case. ThreatConnect provides a set of Workflow Templates via TC Exchange™, or users and administrators with the requisite permissions can create Workflow Templates from scratch.
Endpoint: /api/v3/workflowTemplates
Available Fields¶
You can retrieve a list of available fields for the /v3/workflowTemplates
endpoint, including each field’s name, description, and accepted data type, by using the following query:
OPTIONS /v3/workflowTemplates
Hint
To view all fields, including read-only fields, include the ?show=readonly
query parameter.
Alternatively, refer to the following table for a list of available fields that can be included in the body of a POST or PUT request for the workflowTemplates
object.
Field | Description | Type | Required for Creation? | Updatable? | Example Value(s) |
---|---|---|---|---|---|
configAttribute | The Attribute Type to include in the Workflow Template | Config Attribute Object | FALSE | TRUE | [{“attributeTypeId”: 3}] |
description | The description of the Workflow Template | String | FALSE | TRUE | “Template for phishing investigations.” |
name | The name of the Workflow Template | String | True | TRUE | “Phishing Workflow Template” |
version | The version of the Workflow Template | Integer | FALSE | TRUE | 1, 2, 3 |
Note
Alist of available Attribute Types and their corresponding ID can be retrieved with the following query:
GET /v3/attributeTypes
Create Workflow Templates¶
The basic format for creating a Workflow Template is:
POST /v3/workflowTemplates
{
"name": "Example Workflow Template"
}
For example, the following query will create a Workflow Template with the name Phishing Investigation Template
and a description of the Template:
POST /v3/workflowTemplates
{
"name": "Phishing Investigation Template",
"description": "Template for phishing investigations."
}
JSON Response:
{
"data": {
"id": 3,
"name": "Phishing Investigation Template",
"description": "Template for phishing investigations.",
"active": false,
"version": 1
},
"message": "Created",
"status": "Success"
}
Refer to the Available Fields and section for a list of available fields that can be included in the body of a POST request for the workflowTemplates
object.
Retrieve Workflow Templates¶
Retrieve All Workflow Templates¶
To retrieve all Workflow Templates, use the following query:
GET /v3/workflowTemplates
JSON Response:
{
"data": [
{
"id": 1,
"name": "Example Template",
"description": "A description for this Workflow Template.",
"active": false,
"version": 1,
"configAttribute": [{
"attributeTypeId": 86
}]
},
{
"id": 2,
"name": "Demo Template with Tasks",
"configTask": [
{
"configPlaybook": null,
"fields": [],
"name": "Create a Meeting Notes folder",
"workflowId": 2,
"workflowPhase": 1,
"workflowStep": 1,
"assignee": {
"displayName": "Pat Jones",
"id": 2,
"name": "[email protected]",
"type": "User",
"ownerId": 7,
"superUser": false,
"firstName": "Pat",
"lastName": "Jones"
},
"duration": 2
},
{
"configPlaybook": null,
"fields": [
{
"artifactType": "Email Address",
"dataType": "String",
"intelType": "indicator-EmailAddress",
"name": "emailAddress",
"required": true,
"uiElement": "String",
"uiLabel": "Email Address"
},
{
"artifactType": "Email Subject",
"dataType": "String",
"intelType": "indicator-Email Subject",
"name": "emailSubject",
"required": true,
"uiElement": "String",
"uiLabel": "Email Subject"
}
],
"name": "Analyze Email",
"workflowId": 2,
"workflowPhase": 2,
"workflowStep": 2,
"assignee": null,
"dependentOnTaskName": "Confirm Receipt of Email",
"duration": 3
},
{
"configPlaybook": null,
"fields": [],
"name": "Confirm Receipt of Email",
"workflowId": 2,
"workflowPhase": 2,
"workflowStep": 1,
"assignee": null
}
],
"active": true,
"version": 1
},
{...}
],
"status": "Success"
}
Retrieve a Single Workflow Template¶
To retrieve a specific Workflow Template, use a query in the following format:
GET /v3/workflowTemplates/{workflowTemplateId}
For example, the following query will return information about the Workflow template with ID 1:
GET /v3/workflowTemplates/1
JSON Response:
{
"data": {
"id": 1,
"name": "Example Template",
"description": "A description for this Workflow Template.",
"active": false,
"version": 1,
"configAttribute": [{
"attributeTypeId": 86
}]
},
"status": "Success"
}
Request Additional Fields¶
To request additional fields not automatically included with each returned object, refer to Include Additional Fields for Returned Objects.
Filter Results¶
To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.
Update Workflow Templates¶
The basic format for updating a Workflow Template is:
PUT /v3/workflowTemplates/{workflowTemplateId}
{
{updatedField}: {updatedValue}
}
For example, the following query will update the name and version number of the Workflow Template with ID 3 and add an Attribute Type to the Workflow Template:
PUT /v3/workflowTemplates/3
{
"name": "Example Workflow Template Version 2.0",
"version": 2,
"configAttribute": [{"attributeTypeId": 3}]
}
JSON Response:
{
"data": {
"name": "Example Workflow Template Version 2.0",
"description": "Template for phishing investigations.",
"active": false,
"version": 2,
"configAttribute": [{
"attributeTypeId": 3
}]
},
"message": "Updated",
"status": "Success"
}
Refer to the Available Fields and section for a list of available fields that can be included in the body of a PUT request for the workflowTemplates
object.
Delete Workflow Templates¶
The basic format to delete a Workflow Template is:
DELETE /v3/workflowTemplates/{workflowTemplateId}
For example, the following query will delete the Workflow Template with ID 1:
DELETE /v3/workflowTemplates/1
JSON Response:
{
"message": "Deleted",
"status": "Success"
}
Delete Workflow Templates in Bulk¶
To delete Workflow Templates in bulk, refer to Delete Case Objects in Bulk.