--- title: "[restSearch] Get a filtered and paginated list of events" method: POST path: "/events/restSearch" tags: ["Events"] --- # \[restSearch\] Get a filtered and paginated list of events `POST /events/restSearch` **This is the recommended endpoint for searching events.** ## Request body - object - `page` integer, nullable - `limit` integer, nullable - `value` string - `type` 'md5' | 'sha1' | 'sha256' | 'filename' | 'pdb' | 'filename|md5' | 'filename|sha1' | 'filename|sha256' | 'ip-src' | 'ip-dst' | 'hostname' | 'domain' | 'domain|ip' | 'email' | 'email-src' | 'eppn' | 'email-dst' | 'email-subject' | 'email-attachment' | 'email-body' | 'float' | 'git-commit-id' | 'url' | 'http-method' | 'user-agent' | 'ja3-fingerprint-md5' | 'jarm-fingerprint' | 'favicon-mmh3' | 'hassh-md5' | 'hasshserver-md5' | 'regkey' | 'regkey|value' | 'AS' | 'snort' | 'bro' | 'zeek' | 'community-id' | 'pattern-in-file' | 'pattern-in-traffic' | 'pattern-in-memory' | 'pattern-filename' | 'pgp-public-key' | 'pgp-private-key' | 'yara' | 'stix2-pattern' | 'sigma' | 'gene' | 'kusto-query' | 'mime-type' | 'identity-card-number' | 'cookie' | 'vulnerability' | 'cpe' | 'weakness' | 'attachment' | 'malware-sample' | 'link' | 'comment' | 'text' | 'hex' | 'other' | 'named pipe' | 'mutex' | 'process-state' | 'target-user' | 'target-email' | 'target-machine' | 'target-org' | 'target-location' | 'target-external' | 'btc' | 'dash' | 'xmr' | 'iban' | 'bic' | 'bank-account-nr' | 'aba-rtn' | 'bin' | 'cc-number' | 'prtn' | 'phone-number' | 'threat-actor' | 'campaign-name' | 'campaign-id' | 'malware-type' | 'uri' | 'authentihash' | 'vhash' | 'ssdeep' | 'imphash' | 'telfhash' | 'pehash' | 'impfuzzy' | 'sha224' | 'sha384' | 'sha512' | 'sha512/224' | 'sha512/256' | 'sha3-224' | 'sha3-256' | 'sha3-384' | 'sha3-512' | 'tlsh' | 'cdhash' | 'filename|authentihash' | 'filename|vhash' | 'filename|ssdeep' | 'filename|imphash' | 'filename|impfuzzy' | 'filename|pehash' | 'filename|sha224' | 'filename|sha384' | 'filename|sha512' | 'filename|sha512/224' | 'filename|sha512/256' | 'filename|sha3-224' | 'filename|sha3-256' | 'filename|sha3-384' | 'filename|sha3-512' | 'filename|tlsh' | 'windows-scheduled-task' | 'windows-service-name' | 'windows-service-displayname' | 'whois-registrant-email' | 'whois-registrant-phone' | 'whois-registrant-name' | 'whois-registrant-org' | 'whois-registrar' | 'whois-creation-date' | 'x509-fingerprint-sha1' | 'x509-fingerprint-md5' | 'x509-fingerprint-sha256' | 'dns-soa-email' | 'size-in-bytes' | 'counter' | 'datetime' | 'port' | 'ip-dst|port' | 'ip-src|port' | 'hostname|port' | 'mac-address' | 'mac-eui-64' | 'email-dst-display-name' | 'email-src-display-name' | 'email-header' | 'email-reply-to' | 'email-x-mailer' | 'email-mime-boundary' | 'email-thread-index' | 'email-message-id' | 'github-username' | 'github-repository' | 'github-organisation' | 'jabber-id' | 'twitter-id' | 'dkim' | 'dkim-signature' | 'first-name' | 'middle-name' | 'last-name' | 'full-name' | 'date-of-birth' | 'place-of-birth' | 'gender' | 'passport-number' | 'passport-country' | 'passport-expiration' | 'redress-number' | 'nationality' | 'visa-number' | 'issue-date-of-the-visa' | 'primary-residence' | 'country-of-residence' | 'special-service-request' | 'frequent-flyer-number' | 'travel-details' | 'payment-details' | 'place-port-of-original-embarkation' | 'place-port-of-clearance' | 'place-port-of-onward-foreign-destination' | 'passenger-name-record-locator-number' | 'mobile-application-id' | 'chrome-extension-id' | 'cortex' | 'boolean' | 'anonymised' - `category` 'Internal reference' | 'Targeting data' | 'Antivirus detection' | 'Payload delivery' | 'Artifacts dropped' | 'Payload installation' | 'Persistence mechanism' | 'Network activity' | 'Payload type' | 'Attribution' | 'External analysis' | 'Financial fraud' | 'Support Tool' | 'Social network' | 'Person' | 'Other' - `org` union - string - string - `tags` string[], nullable - `event_tags` string[], nullable - `searchall` string — Search events by matching any tag names, event descriptions, attribute values or attribute comments - `from` string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.) - `to` string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.) - `last` union — Events published within the last x amount of time, where x can be defined in days, hours, minutes (for example 5d or 12h or 30m), ISO 8601 datetime format or timestamp - integer - string - `eventid` string - `withAttachments` boolean — Extends the response with the base64 representation of the attachment, if there is one - `sharinggroup` string[], nullable — Sharing group ID(s), either as single string or list of IDs - `metadata` boolean, nullable — Will only return the metadata of the given query scope, contained data is omitted. - `uuid` string, uuid - `publish_timestamp` string - `timestamp` string - `published` boolean - `enforceWarninglist` boolean, nullable — Should the warning list be enforced. Adds blocked field for matching attributes - `sgReferenceOnly` boolean — Will only return the sharing group ID - `requested_attributes` string[] — List of properties that will be selected in the CSV export - `includeContext` boolean, nullable — Adds events context fields in the CSV export - `headerless` boolean, nullable — Removes header in the CSV export - `includeWarninglistHits` boolean, nullable - `attackGalaxy` string, nullable - `to_ids` boolean - `deleted` boolean — Whether to include soft-deleted attributes. Default value 0. If set to 1, only deleted attributes will be returned. If set to [0,1], both deleted and non-deleted attributes wil be returned. - `excludeLocalTags` boolean, nullable — Exclude local tags from the export - `date` string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.) - `includeSightingdb` boolean, nullable — Extend response with Sightings DB results if the module is enabled - `tag` string - `object_relation` string, nullable — Filter by the attribute object relation value - `threat_level_id` '1' | '2' | '3' | '4' — Represents the threat level. * `1` - High * `2` - Medium * `3` - Low * `4` - Undefined - `returnFormat` 'json' | 'xml' | 'csv' | 'text' | 'stix' | 'stix2' | 'stix-json' | 'attack' | 'attack-sightings' | 'cache' | 'count' | 'hashes' | 'netfilter' | 'opendata' | 'openioc' | 'rpz' | 'snort' | 'suricata' | 'yara' | 'yara-json' — Format of the response payload ## Response `200` Rest search events response - object - `response` object[] ## Other responses - `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header. - `default` — Unexpected API error ## Changes - **2024-07-11** `7cd8b1880b11` — 16 breaking, 8 warning, 20 info - removed the enum value `edge-extension-id` of the request property `type` - removed the enum value `suricata` of the request property `type` - the response property `response/items/Event/allOf[#/components/schemas/ExtendedEvent]/allOf[#/components/schemas/Event]/allOf[#/components/schemas/EventNoId]/sharing_group_id` became nullable for the status `200` - the response property `response/items/Event/allOf[#/components/schemas/ExtendedEvent]/allOf[subschema #2]/Attribute/items/allOf[#/components/schemas/AttributeNoId]/sharing_group_id` became nullable for the status `200` - …40 more [Change history](https://skmtc.dev/misp/apis/misp-automation-api/changes/events/restSearch/post.md) --- [API](https://skmtc.dev/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.dev/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/00c36cd68bb5/schema)