Log

Get a list of incidents

get/log/incident

Request

Headers

X-Auth-Tokenstring required

Response

Success

Example response

{
  "incidents": [
    {
      "name": "Host.Suspicious.Process",
      "level": "WARNING",
      "reported_timestamp": 1515020888,
      "reported_at": "2018-01-03T23:08:08Z",
      "cluster_name": "cluster1",
      "response_rule_id": 10006,
      "host_id": "ubuntu64:ZYA3:UZL5:2WOT:QYEF:SLVT:LIBD",
      "host_name": "ubuntu64",
      "enforcer_id": "a928be54f34fbb696426890a7249c067",
      "enforcer_name": "allinone",
      "id": "e6e19591-75a0-43e9-bebb-145d588e6718",
      "workload_id": "83e76eabd68494649440fa0a35451315289c70eb3094454e419952dffaa7715a",
      "workload_name": "iperfserver",
      "workload_image": "iperfserver",
      "workload_service": "iperfserver",
      "remote_workload_id": "external",
      "remote_workload_name": "iperfclient",
      "remote_workload_image": "iperfclient",
      "remote_workload_service": "iperfclient",
      "proc_name": "nc",
      "proc_path": "/bin/nc.traditional",
      "proc_cmd": "./dns_tunneling/iodine/bin/iodine -f -r 172.17.0.3 -P",
      "proc_real_uid": 1000,
      "proc_effective_uid": 1000,
      "proc_real_user": "test",
      "proc_effective_user": "root",
      "client_ip": "192.168.1.62",
      "server_ip": "10.1.4.3",
      "client_port": 56564,
      "server_port": 80,
      "server_conn_port": 80,
      "ether_type": 2048,
      "ip_proto": 6,
      "proc_parent_name": "sh",
      "proc_parent_path": "/bin/dash",
      "action": "violate",
      "group": "nv.iperfserver",
      "rule_id": "00000000-0000-0000-0000-000000000001",
      "aggregation_from": 1515020888,
      "count": 1,
      "message": "dns tunneling"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.