User Groups

User groups are teams of users that can be assigned to Workflow Cases and Workflow Tasks.

Endpoint: /api/v3/security/userGroups

Available Fields

A list of fields for the v3/security/userGroups endpoint, which is a read-only endpoint, can be retrieved using the following query:

OPTIONS /v3/security/userGroups?show=readonly

Retrieve User Groups

Retrieve All User Groups

To retrieve all user groups in the Organization in which your API user account resides, use the following query:

GET /v3/security/userGroups

JSON Response:

{
    "data": [
        {
            "id": 1,
            "name": "SOC Team",
            "description": "Main SOC users"
        },
        {
            "id": 2,
            "name": "IR Team",
            "description": "IR Team members, Levels 1-3"
        },
        {
            "id": 3,
            "name": "TI Team",
            "description": "Threat Intel Team, all levels"
        }
    ],
    "status": "Success"
}

Retrieve a Single User Group

To retrieve a specific user group in the Organization in which your API user account resides, use a query in the following format:

GET /v3/security/userGroups/{userGroupId}

For example, the following query will return information about the user group with ID 3:

GET /v3/security/userGroups/3

JSON Response:

{
    "data": {
        "id": 3,
        "name": "TI Team",
        "description": "Threat Intel Team, all levels"
    },
    "status": "Success"
}

Request Additional Fields

To request additional fields not automatically included with each returned object, refer to Include Additional Fields for Returned Objects.

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.