Case Management

Create an Alert

Adds a new Alert record.

post/workspace/{ws_id}/case_management/table/alerts

Request

Base URL
https://your-tenant.app.blinkops.com/api/v1
URL
https://your-tenant.app.blinkops.com/api/v1/workspace/{ws_id}/case_management/table/alerts
Auth
API key in header BLINK-API-KEY

Path parameters

ws_idstring required

Workspace ID

Request body /

descriptionstring

eventstring

namestring

processing_status'Unprocessed' | 'Missing Template' | 'Mid-processing' | 'Bad Template' | 'Processed'

severityinteger

type'Malware' | 'Ransomware' | 'Adware' | 'Spyware' | 'Crypto Miner' | 'Data Exfiltration' | 'Insider Threat' | 'Network Intrusion' | 'DoS' | 'DDoS' | 'MITM' | 'SQL Injection' | 'Email Spoofing' | 'DNS Spoofing' | 'C2 Communications' | 'Rogue Device' | 'Brute Force' | 'Phishing' | 'Compromised Credentials' | 'Account Takeover' | 'Physical' | 'Vulnerability' | 'Reconnaissance' | 'Domain Takeover' | 'Lateral Movement' | 'Network Exposure' | 'Data Exposure' | 'Credential Exposure' | 'Suspicious User Activity' | 'Suspicious Login' | 'Suspicious Network Activity' | 'Suspicious USB Device' | 'Security Policy Violation' | 'Security Compliance Violation'

vendor'CrowdStrike' | 'Checkpoint' | 'Delinea' | 'Securonix' | 'Falcon LogScale' | 'Splunk' | 'ArcSight' | 'SolarWinds Service Desk' | 'Datadog' | 'SentinelOne' | 'Microsoft Defender For Cloud' | 'Microsoft Defender For Cloud Apps' | 'Microsoft Defender For Endpoints'

Example request

{
  "description": "Malware detected and blocked by CrowdStrike Falcon",
  "event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
  "name": "CrowdStrike Falcon Detection",
  "processing_status": "Missing Template",
  "severity": 3,
  "type": "Endpoint Detection and Response (EDR)",
  "vendor": "CrowdStrike"
}

Response

OK

descriptionstring

eventstring

namestring

processing_status'Unprocessed' | 'Missing Template' | 'Mid-processing' | 'Bad Template' | 'Processed'

severityinteger

type'Malware' | 'Ransomware' | 'Adware' | 'Spyware' | 'Crypto Miner' | 'Data Exfiltration' | 'Insider Threat' | 'Network Intrusion' | 'DoS' | 'DDoS' | 'MITM' | 'SQL Injection' | 'Email Spoofing' | 'DNS Spoofing' | 'C2 Communications' | 'Rogue Device' | 'Brute Force' | 'Phishing' | 'Compromised Credentials' | 'Account Takeover' | 'Physical' | 'Vulnerability' | 'Reconnaissance' | 'Domain Takeover' | 'Lateral Movement' | 'Network Exposure' | 'Data Exposure' | 'Credential Exposure' | 'Suspicious User Activity' | 'Suspicious Login' | 'Suspicious Network Activity' | 'Suspicious USB Device' | 'Security Policy Violation' | 'Security Compliance Violation'

vendor'CrowdStrike' | 'Checkpoint' | 'Delinea' | 'Securonix' | 'Falcon LogScale' | 'Splunk' | 'ArcSight' | 'SolarWinds Service Desk' | 'Datadog' | 'SentinelOne' | 'Microsoft Defender For Cloud' | 'Microsoft Defender For Cloud Apps' | 'Microsoft Defender For Endpoints'

Example response

{
  "description": "Malware detected and blocked by CrowdStrike Falcon",
  "event": "{\"process\": \"malware.exe\", \"action\": \"blocked\"}",
  "name": "CrowdStrike Falcon Detection",
  "processing_status": "Missing Template",
  "severity": 3,
  "type": "Endpoint Detection and Response (EDR)",
  "vendor": "CrowdStrike"
}

Changes

No recorded changes to this operation across all 2 revisions of this API.