User Groups

User groups are teams of users to which Workflow Cases and Workflow Tasks can be assigned.

Endpoint: /api/v3/security/userGroups

Available Fields

A list of valid fields for the v3/security/userGroups endpoint, which is a read-only endpoint, can be retrieved using the following query:

OPTIONS /v3/security/userGroups?show=readonly

Retrieve User Groups

Retrieve All User Groups

To retrieve all user groups in the Organization in which your API user account resides, use the following query:

GET /v3/security/userGroups

JSON Response:

{
    "data": [
        {
            "id": 1,
            "name": "SOC Team",
            "description": "Main SOC users"
        },
        {
            "id": 2,
            "name": "IR Team",
            "description": "IR Team members, Levels 1-3"
        },
        {
            "id": 3,
            "name": "TI Team",
            "description": "Threat Intel Team, all levels"
        },
    ],
    "status": "Success"
}

Retrieve a Single User Group

To retrieve a specific user group in the Organization in which your API user account resides, use a query in the following format:

GET /v3/security/userGroups/{userGroupId}

For example, the following query will return information about the user group with ID 3:

GET /v3/security/userGroups/3

JSON Response:

{
    "data": {
        "id": 3,
        "name": "IR Team",
        "description": "IR Team members, Levels 1-3"
    },
    "status": "Success"
}

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.