--- title: "List Security Event" method: POST path: "/security-events/get-list" tags: ["Security Event"] --- # List Security Event `POST /security-events/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-events/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Security Event items ## Request body - object - `query` SecurityEventItemV1QuerySchema: Query schema for SecurityEventItemV1. A field takes a plain value, which it matches exactly, or an operator its type allows. Telemetry tables are large: bound every query by time. - `projectId` union: Query operators for projectId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `primaryEntityId` union: Query operators for primaryEntityId field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `primaryEntityType` union: Query operators for primaryEntityType field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `time` union: Query operators for time field of type DateTime64. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `eventUid` union: Query operators for eventUid field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `categoryUid` union: Query operators for categoryUid field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. - number - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `categoryName` union: Query operators for categoryName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `classUid` union: Query operators for classUid field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. - number - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `className` union: Query operators for className field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `activityName` union: Query operators for activityName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `severityId` union: Query operators for severityId field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. - number - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `severityName` union: Query operators for severityName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `statusName` union: Query operators for statusName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `message` union: Query operators for message field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `vendorName` union: Query operators for vendorName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `productName` union: Query operators for productName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `ruleId` union: Query operators for ruleId field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `ruleName` union: Query operators for ruleName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `mitreTactics` union: Query operators for mitreTactics field of type Array of Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, Search. EqualTo, NotEqual and Search match one element; Includes matches any of several. - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'Search', required - `value` string, required - `mitreTechniques` union: Query operators for mitreTechniques field of type Array of Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, Search. EqualTo, NotEqual and Search match one element; Includes matches any of several. - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'Search', required - `value` string, required - `principalUser` union: Query operators for principalUser field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `principalHost` union: Query operators for principalHost field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `principalIp` union: Query operators for principalIp field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `principalProcess` union: Query operators for principalProcess field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `processName` union: Query operators for processName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `processPath` union: Query operators for processPath field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `processCommandLine` union: Query operators for processCommandLine field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `parentProcessName` union: Query operators for parentProcessName field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `parentProcessPath` union: Query operators for parentProcessPath field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `parentProcessCommandLine` union: Query operators for parentProcessCommandLine field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `targetUser` union: Query operators for targetUser field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `targetHost` union: Query operators for targetHost field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `targetIp` union: Query operators for targetIp field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `targetPort` union: Query operators for targetPort field of type Number. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. - number - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `targetResource` union: Query operators for targetResource field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `observables` union: Query operators for observables field of type Array of Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, Search. EqualTo, NotEqual and Search match one element; Includes matches any of several. - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'Search', required - `value` string, required - `traceId` union: Query operators for traceId field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `spanId` union: Query operators for spanId field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `sessionId` union: Query operators for sessionId field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `requestOutcome` union: Query operators for requestOutcome field of type Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, EqualToOrNull, Search. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - `attributes` object: Query operators for attributes field of type Map(String, String). Supported operators: EqualTo, NotEqual, IsNull, NotNull, Search. Filtered by key, each key with these operators: {"attributes": {"": }}. - `attributeKeys` union: Query operators for attributeKeys field of type Array of Text. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes, Search. EqualTo, NotEqual and Search match one element; Includes matches any of several. - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - object - `_type` 'Search', required - `value` string, required - `_id` union: Query operators for _id field of type Object ID. Supported operators: EqualTo, NotEqual, IsNull, NotNull, Includes. - string - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: Query operators for createdAt field of type Date. Supported operators: EqualTo, NotEqual, IsNull, NotNull, GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `select` SecurityEventItemV1SelectSchema: Select schema for SecurityEventItemV1. Set fields to true to include them in the response. - `projectId` boolean - `primaryEntityId` boolean - `primaryEntityType` boolean - `time` boolean - `eventUid` boolean - `categoryUid` boolean - `categoryName` boolean - `classUid` boolean - `className` boolean - `activityName` boolean - `severityId` boolean - `severityName` boolean - `statusName` boolean - `message` boolean - `vendorName` boolean - `productName` boolean - `ruleId` boolean - `ruleName` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `principalUser` boolean - `principalHost` boolean - `principalIp` boolean - `principalProcess` boolean - `processName` boolean - `processPath` boolean - `processCommandLine` boolean - `parentProcessName` boolean - `parentProcessPath` boolean - `parentProcessCommandLine` boolean - `targetUser` boolean - `targetHost` boolean - `targetIp` boolean - `targetPort` boolean - `targetResource` boolean - `observables` boolean - `traceId` boolean - `spanId` boolean - `sessionId` boolean - `requestOutcome` boolean - `attributes` boolean - `attributeKeys` boolean - `_id` boolean - `createdAt` boolean - `sort` SecurityEventItemV1SortSchema: Sort schema for SecurityEventItemV1. Only sortable fields are included. - `projectId` 'ASC' | 'DESC': Sort order for projectId field - `primaryEntityId` 'ASC' | 'DESC': Sort order for primaryEntityId field - `primaryEntityType` 'ASC' | 'DESC': Sort order for primaryEntityType field - `time` 'ASC' | 'DESC': Sort order for time field - `eventUid` 'ASC' | 'DESC': Sort order for eventUid field - `categoryUid` 'ASC' | 'DESC': Sort order for categoryUid field - `categoryName` 'ASC' | 'DESC': Sort order for categoryName field - `classUid` 'ASC' | 'DESC': Sort order for classUid field - `className` 'ASC' | 'DESC': Sort order for className field - `activityName` 'ASC' | 'DESC': Sort order for activityName field - `severityId` 'ASC' | 'DESC': Sort order for severityId field - `severityName` 'ASC' | 'DESC': Sort order for severityName field - `statusName` 'ASC' | 'DESC': Sort order for statusName field - `message` 'ASC' | 'DESC': Sort order for message field - `vendorName` 'ASC' | 'DESC': Sort order for vendorName field - `productName` 'ASC' | 'DESC': Sort order for productName field - `ruleId` 'ASC' | 'DESC': Sort order for ruleId field - `ruleName` 'ASC' | 'DESC': Sort order for ruleName field - `principalUser` 'ASC' | 'DESC': Sort order for principalUser field - `principalHost` 'ASC' | 'DESC': Sort order for principalHost field - `principalIp` 'ASC' | 'DESC': Sort order for principalIp field - `principalProcess` 'ASC' | 'DESC': Sort order for principalProcess field - `processName` 'ASC' | 'DESC': Sort order for processName field - `processPath` 'ASC' | 'DESC': Sort order for processPath field - `processCommandLine` 'ASC' | 'DESC': Sort order for processCommandLine field - `parentProcessName` 'ASC' | 'DESC': Sort order for parentProcessName field - `parentProcessPath` 'ASC' | 'DESC': Sort order for parentProcessPath field - `parentProcessCommandLine` 'ASC' | 'DESC': Sort order for parentProcessCommandLine field - `targetUser` 'ASC' | 'DESC': Sort order for targetUser field - `targetHost` 'ASC' | 'DESC': Sort order for targetHost field - `targetIp` 'ASC' | 'DESC': Sort order for targetIp field - `targetPort` 'ASC' | 'DESC': Sort order for targetPort field - `targetResource` 'ASC' | 'DESC': Sort order for targetResource field - `traceId` 'ASC' | 'DESC': Sort order for traceId field - `spanId` 'ASC' | 'DESC': Sort order for spanId field - `sessionId` 'ASC' | 'DESC': Sort order for sessionId field - `requestOutcome` 'ASC' | 'DESC': Sort order for requestOutcome field - `retentionDate` 'ASC' | 'DESC': Sort order for retentionDate field - `_id` 'ASC' | 'DESC': Sort order for _id field - `createdAt` 'ASC' | 'DESC': Sort order for createdAt field - `groupBy` SecurityEventItemV1GroupBySchema: Group by schema for SecurityEventItemV1. Only one field can be set to true for grouping. - `projectId` boolean: Group by projectId field. Only one field can be selected for grouping. - `primaryEntityId` boolean: Group by primaryEntityId field. Only one field can be selected for grouping. - `primaryEntityType` boolean: Group by primaryEntityType field. Only one field can be selected for grouping. - `eventUid` boolean: Group by eventUid field. Only one field can be selected for grouping. - `categoryUid` boolean: Group by categoryUid field. Only one field can be selected for grouping. - `categoryName` boolean: Group by categoryName field. Only one field can be selected for grouping. - `classUid` boolean: Group by classUid field. Only one field can be selected for grouping. - `className` boolean: Group by className field. Only one field can be selected for grouping. - `activityName` boolean: Group by activityName field. Only one field can be selected for grouping. - `severityId` boolean: Group by severityId field. Only one field can be selected for grouping. - `severityName` boolean: Group by severityName field. Only one field can be selected for grouping. - `statusName` boolean: Group by statusName field. Only one field can be selected for grouping. - `message` boolean: Group by message field. Only one field can be selected for grouping. - `vendorName` boolean: Group by vendorName field. Only one field can be selected for grouping. - `productName` boolean: Group by productName field. Only one field can be selected for grouping. - `ruleId` boolean: Group by ruleId field. Only one field can be selected for grouping. - `ruleName` boolean: Group by ruleName field. Only one field can be selected for grouping. - `principalUser` boolean: Group by principalUser field. Only one field can be selected for grouping. - `principalHost` boolean: Group by principalHost field. Only one field can be selected for grouping. - `principalIp` boolean: Group by principalIp field. Only one field can be selected for grouping. - `principalProcess` boolean: Group by principalProcess field. Only one field can be selected for grouping. - `processName` boolean: Group by processName field. Only one field can be selected for grouping. - `processPath` boolean: Group by processPath field. Only one field can be selected for grouping. - `processCommandLine` boolean: Group by processCommandLine field. Only one field can be selected for grouping. - `parentProcessName` boolean: Group by parentProcessName field. Only one field can be selected for grouping. - `parentProcessPath` boolean: Group by parentProcessPath field. Only one field can be selected for grouping. - `parentProcessCommandLine` boolean: Group by parentProcessCommandLine field. Only one field can be selected for grouping. - `targetUser` boolean: Group by targetUser field. Only one field can be selected for grouping. - `targetHost` boolean: Group by targetHost field. Only one field can be selected for grouping. - `targetIp` boolean: Group by targetIp field. Only one field can be selected for grouping. - `targetPort` boolean: Group by targetPort field. Only one field can be selected for grouping. - `targetResource` boolean: Group by targetResource field. Only one field can be selected for grouping. - `traceId` boolean: Group by traceId field. Only one field can be selected for grouping. - `spanId` boolean: Group by spanId field. Only one field can be selected for grouping. - `sessionId` boolean: Group by sessionId field. Only one field can be selected for grouping. - `requestOutcome` boolean: Group by requestOutcome field. Only one field can be selected for grouping. - `_id` boolean: Group by _id field. Only one field can be selected for grouping. - `createdAt` boolean: Group by createdAt field. Only one field can be selected for grouping. - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityEventItemV1[] - `projectId` string, required: Project ID - `primaryEntityId` string, required: Source ID - `primaryEntityType` string: Source Type - `time` string: Time - `eventUid` string: Event UID - `categoryUid` number: Category UID - `categoryName` string: Category - `classUid` number: Class UID - `className` string: Event Class - `activityName` string: Activity - `severityId` number: Severity ID - `severityName` string: Severity - `statusName` string: Status - `message` string: Message - `vendorName` string: Vendor - `productName` string: Product - `ruleId` string: Rule ID - `ruleName` string: Rule Name - `mitreTactics` string[]: MITRE Tactics - `mitreTechniques` string[]: MITRE Techniques - `principalUser` string: Principal User - `principalHost` string: Principal Host - `principalIp` string: Principal IP - `principalProcess` string: Principal Process - `processName` string: Process - `processPath` string: Process Path - `processCommandLine` string: Command Line - `parentProcessName` string: Parent Process - `parentProcessPath` string: Parent Process Path - `parentProcessCommandLine` string: Parent Command Line - `targetUser` string: Target User - `targetHost` string: Target Host - `targetIp` string: Target IP - `targetPort` number: Target Port - `targetResource` string: Target Resource - `observables` string[]: Observables - `traceId` string: Trace ID - `spanId` string: Span ID - `sessionId` string: Session ID - `requestOutcome` string: Request Outcome - `attributes` string: Attributes - `attributeKeys` string[]: Attribute Keys - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)