Watchtower

Data types

• Sources
• RawIntake
• Signals
• Tickets
• IntelRequirements
• CollectionTasks
• Briefings
• WatchlistEntities
• AutomationLogs
• APIRegistry
• APIEndpoints
• APITestResults
• AlertRule
• Alert
• AuditEvent
• BriefingItem
• DemoQAChecklist
• EvaluationComparison
• MobileDemoReadiness
• IndicatorWarning
• TripwireRule
• NewsReport
• ThreatActorProfile
• LeadershipAttentionItem
• PriorityIntelligenceRequirement
• CollectionGap
• EvidenceRecord
• OTAssetProfile
• FrameworkMapping
• CyberTechniqueMapping
• VulnerabilityIntel
• StructuredThreatIntelObject
• HypothesisAnalysis
• AIAssistedOutput
• SituationRoom
• SituationUpdate
• ExecutiveDecisionMemo
• IntelligenceValueMetric
• TeamWorkload
• LeadershipDecision
• Signal
• IntelligenceReport
• CompanyRelevanceFactor
• BusinessImpactProfile
• IntelligenceAction
• ProductFeedback
• RSSFeedSource
• SourceHealthSnapshot
• AutomationRun
• AdminSettings
• RSSClassificationRule
• GuidanceSource
• GuidanceDocument
• GuidanceDocumentVersion
• GuidanceReview
• IntegrationRegistry
• TicketIntegrationConfig
• TicketFieldMapping
• SourceApproval
• NotificationRule
• NotificationEvent
• Digest
• DataQualityIssue
• ApprovalRequest
• TrainingModule
• UserTrainingProgress
• OperatingRoutine
• RoleResponsibility
• IntegrationRequest
• IntegrationEndpoint
• DataGovernancePolicy
• DataRetentionJob
• CTIIndicator
• CTISighting
• CTIObservable
• CTIThreatActor
• CTIIntrusionSet
• CTICampaign
• CTIMalware
• CTITool
• CTIInfrastructure
• CTIAttackMapping
• CTIDetectionAnalytic
• CTIDetectionGap
• CTIVulnerabilityIntel
• CTIHuntHypothesis
• CTIHuntRun
• CTIIncidentBridge
• CTIPackage
• TAXIICollectionConfig
• CTIQualityIssue
• CTIIndicatorLifecycleEvent
• CTIInvestigation
• CTIInvestigationNote
• CTIPivotEvent
• CTIEnrichmentProvider
• CTIEnrichmentResult
• CTIPivotChain
• DetectionRule
• DetectionRuleTest
• DetectionPack
• MalwareSampleRecord
• YaraSignatureRule
• YaraRuleTest
• TelemetrySourceCatalog
• TelemetryCoverageGap
• AttackNavigatorLayer
• D3fendCountermeasureMapping
• VictimologyRecord
• SectorTrendRecord
• CTIProductTemplate
• DefensePlaybook
• DefensePlaybookStep
• DefensePlaybookRun
• DefensePlaybookTest
• ResponseActionTemplate
• ResponseActionRun
• OpenC2ActionProfile
• ExposureFinding
• AttackPath
• CompensatingControl
• ProductInventoryItem
• VendorSecurityAdvisory
• SBOMRecord
• VEXStatement
• ProductExposureAssessment
• ValidationScenario
• ValidationRun
• ControlAssertion
• DetectionSuppression
• IntelException
• RiskAcceptanceRecord
• DefenseAssuranceMetric
• Incident
• SecurityAlert
• AlertSourceProfile
• AlertCorrelationCluster
• IncidentRecord
• IncidentPhaseChange
• IncidentImpactAssessment
• IncidentTimelineEvent
• IncidentArtifact
• IncidentEvidenceLink
• IncidentResponseDecision
• RecoveryMilestone
• IncidentStakeholder
• IncidentUpdate
• IncidentDecisionLog
• IncidentDetectionFeedback
• IncidentDetectionGap
• IncidentSLAProfile
• IncidentMetricRecord
• ImportBatch
• UploadedFileRecord
• CrownJewelProcess
• ConsequenceScenario
• OperationalDependency
• JurisdictionProfile
• ObligationSource
• ObligationRequirement
• ObligationEvidence
• ObligationChangeAlert
• SharingCommunityProfile
• StructuredSharingPackage
• ReleasabilityReview
• TelemetryCoverageProfile
• ATTACKCoverageAssertion
• OperatingRegionProfile
• BusinessSegmentProfile
• JurisdictionOverlay
• CrisisEvent
• CrisisObjective
• CrisisDecision
• CriticalServiceProfile
• ServiceImpactSnapshot
• RestorationMilestone
• ContinuityWorkaround
• CoordinationPartner
• CoordinationEngagement
• ExternalCommitment
• NotificationObligation
• CrisisNotificationDraft
• BoardPacketItem
• ExerciseScenario
• ExerciseRun
• ExerciseInject
• ExerciseFinding
• DisruptionSignal
• RegionRiskSnapshot
• ThirdPartyIncidentRecord
• MutualAidRequest
• ThirdPartyActionPlan
• ResilienceMetric
• RegionalCommandNode
• RegionalOperatingPriority
• CrossRegionDependency
• RegionalHandoff
• RegionalHandoffChecklistItem
• RegionalCarryoverItem
• DataResidencyProfile
• AccessBoundaryRule
• RecordJurisdictionTag
• DelegatedAdminScope
• LocalPublicationRequest
• RegionalObligationOverlay
• SegmentPolicyImpact
• InvestmentCandidate
• InvestmentDecision
• PortfolioRiskCase
• ProductEdition
• BrandProfile
• Organization
• OrganizationMembership
• TenantConfig
• CustomerEnvironment
• SubscriptionPlan
• OrganizationSubscription
• Entitlement
• TrustCenterArtifact
• SecurityFeatureProfile
• OnboardingChecklist
• ActivationMilestone
• ContentPack
• FederatedSyncEvent