User Groups¶
User groups are teams of users that can be assigned to Workflow Cases and Workflow Tasks.
Endpoint: /api/v3/security/userGroups
Available Fields¶
A list of fields for the v3/security/userGroups
endpoint, which is a read-only endpoint, can be retrieved using the following query:
OPTIONS /v3/security/userGroups?show=readonly
Retrieve User Groups¶
Retrieve All User Groups¶
To retrieve all user groups in the Organization in which your API user account resides, use the following query:
GET /v3/security/userGroups
JSON Response:
{
"data": [
{
"id": 1,
"name": "SOC Team",
"description": "Main SOC users"
},
{
"id": 2,
"name": "IR Team",
"description": "IR Team members, Levels 1-3"
},
{
"id": 3,
"name": "TI Team",
"description": "Threat Intel Team, all levels"
}
],
"status": "Success"
}
Retrieve a Single User Group¶
To retrieve a specific user group in the Organization in which your API user account resides, use a query in the following format:
GET /v3/security/userGroups/{userGroupId}
For example, the following query will return information about the user group with ID 3:
GET /v3/security/userGroups/3
JSON Response:
{
"data": {
"id": 3,
"name": "TI Team",
"description": "Threat Intel Team, all levels"
},
"status": "Success"
}
Request Additional Fields¶
To request additional fields not automatically included with each returned object, refer to Include Additional Fields for Returned Objects.
Filter Results¶
To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.