Log
Get a list of incidents
get/log/incident
Request
- Base URL/v1 (relative, and the document was published on a file host, not at the API’s origin)
- Authnone declared. Required headers: X-Auth-Token
- TypeScriptA function with typed inputs. Its response is checked against the schema.
Headers
X-Auth-Tokenstring required
Response
Success
Example response
{
"incidents": [
{
"name": "Host.Suspicious.Process",
"level": "WARNING",
"reported_timestamp": 1515020888,
"reported_at": "2018-01-03T23:08:08Z",
"cluster_name": "cluster1",
"response_rule_id": 10006,
"host_id": "ubuntu64:ZYA3:UZL5:2WOT:QYEF:SLVT:LIBD",
"host_name": "ubuntu64",
"enforcer_id": "a928be54f34fbb696426890a7249c067",
"enforcer_name": "allinone",
"id": "e6e19591-75a0-43e9-bebb-145d588e6718",
"workload_id": "83e76eabd68494649440fa0a35451315289c70eb3094454e419952dffaa7715a",
"workload_name": "iperfserver",
"workload_image": "iperfserver",
"workload_service": "iperfserver",
"remote_workload_id": "external",
"remote_workload_name": "iperfclient",
"remote_workload_image": "iperfclient",
"remote_workload_service": "iperfclient",
"proc_name": "nc",
"proc_path": "/bin/nc.traditional",
"proc_cmd": "./dns_tunneling/iodine/bin/iodine -f -r 172.17.0.3 -P",
"proc_real_uid": 1000,
"proc_effective_uid": 1000,
"proc_real_user": "test",
"proc_effective_user": "root",
"client_ip": "192.168.1.62",
"server_ip": "10.1.4.3",
"client_port": 56564,
"server_port": 80,
"server_conn_port": 80,
"ether_type": 2048,
"ip_proto": 6,
"proc_parent_name": "sh",
"proc_parent_path": "/bin/dash",
"action": "violate",
"group": "nv.iperfserver",
"rule_id": "00000000-0000-0000-0000-000000000001",
"aggregation_from": 1515020888,
"count": 1,
"message": "dns tunneling"
}
]
}Changes
No recorded changes to this operation across all 1 revision of this API.