Filters, rules and taint

Get the unique-event definition

Returns which event fields make two detections DIFFERENT events for the given scope (machine query param = a machine public_id, '' or absent = the account default). axes is the definition in force after resolution (machine setting, else account default, else the built-in default of source+detail); inherited says whether this exact scope carries its own row or is inheriting one. baseline names the parts that are always keyed and cannot be switched off. Fields not listed in axes do not split events: two detections differing only in an unlisted field are one row whose count increments.

This is a read: a read-only API key may call it.

get/api/event_uniqueness/

Request

  • Base URL: https://eyalsec.com
  • URL: https://eyalsec.com/api/event_uniqueness/
  • Auth: one of:
    • API key in header X-API-Key
    • API key in cookie __Host-es2session

Query parameters

agent_kindstring required

Product to read the setting for, e.g. python.

machinestring

Machine public_id to scope to; omit for the account default.

eventinteger

An event id. Scopes to the machine that sent that event, in place of machine; 404 if the event is not yours.

Response

OK.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.