Content work item

A content work item is a tracked request for detection engineering work, holding a name, a description of what the work needs, a status, an assignee, and links to the changesets and detections that implement it. A work item's id is prefixed CWI_.

A work item belongs to one Space, fixed at creation. Triaging a threat report opens a work item for each behavior the Space has no detection for. A work item opened that way is a detection opportunity. You can also create one yourself (in the web app, on the "Content Work Items" list). Creating a work item fires the ContentWorkItemCreated webhook event.

Implementation

The content-engineering agent implements a work item in its own chat. Triage starts a run automatically for every work item it opens. You can also start a run by hand from the work item (in the web app, "Start Simba Implementation"). A run stages its edits in a changeset and links that changeset to the work item. Committing the changeset moves every linked work item still Open to Done.

A run consumes the Space's weekly content-engineering quota. When the quota is exhausted the run does not start, and the work item records implementationSkippedReason as QuotaExceeded. Starting a run by hand then bypasses the quota check and clears the value. A run can also end without staging anything, leaving a work item with no changeset.

Inputs

Field	Type	Required	Description
name	string	Required	The work item's name. At least one character.
spaceId	string	Required	The Space the work item belongs to, prefixed SPC_. Accepted on create only, so a work item never moves between Spaces.
description	string	Optional	What the work needs. For a work item triage opens, this holds the behavior's description, its MITRE ATT&CK tactic and technique, the datasets it concerns, the triage confidence, and a link to the source report.
status	enum	Optional	Open while the work is outstanding, Done once it is implemented, Cancelled when it is dropped. Defaults to Open.
assignedToUserId	string	Optional	The user responsible for the work, prefixed USR_. Null when unassigned.

Outputs

Field	Type	Description
implementationSkippedReason	enum	Why the content-engineering agent did not run. Only value is QuotaExceeded. Null when the run went ahead.
comments	array<object>	Comments on the work item, each with id, text, createdAt, and createdByUserId. Returned by getById only.
chats	array<object>	The chats the work item triggered, one per implementation run. Returned by getById only.
changesets	array<object>	The changesets implementing the work item, narrowed to the ones the caller can read. Empty until a run stages one. Returned by getById only.
detections	array<object>	The detections implementing the work item. Returned by getById only.
threatReports	array<object>	The threat reports whose triage opened this work item, each with id and name. Empty when you created the work item yourself. Returned by getById only.

Plus the common resource fields.

Related

• Detection opportunity, a work item opened from threat intelligence triage.
• Threat report, whose triage opens work items.
• Changesets, where an implementation run stages its edits for review.
• Detections, the content a work item most often asks for.
• Chat, the record of an implementation run.
• Developing detections, why you author and validate a detection.
• Webhooks, whose ContentWorkItemCreated event fires on creation.