--- title: "Create Security Event" method: POST path: "/security-events" tags: ["Security Event"] --- # Create Security Event `POST /security-events` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-events` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to create a new Security Event ## Request body - object - `data` SecurityEventItemV1CreateSchema, required: Create schema for SecurityEventItemV1 - `projectId` string, uuid: ID of project - `primaryEntityId` string, uuid, required: ID of the resource the security event is attributed to (a Telemetry Service representing the security source, e.g. 'Google SecOps') - `primaryEntityType` string: Discriminator for primaryEntityId — tells the read side which resource table to dispatch to - `time` string, date-time, required: When the security event occurred (from the source payload) - `eventUid` string: Source-assigned unique event id (OCSF metadata.uid / UDM metadata.id), or a content hash when the source has none - `categoryUid` number: OCSF category uid (1 System Activity, 2 Findings, 3 IAM, 4 Network Activity, 5 Discovery, 6 Application Activity; 0 uncategorized) - `categoryName` string: OCSF category name - `classUid` number: OCSF event class uid (e.g. 3002 Authentication, 4003 DNS Activity, 2004 Detection Finding; 0 unmapped) - `className` string: OCSF event class name - `activityName` string: OCSF activity within the event class (Logon, Create, ...) - `severityId` number: OCSF severity id (0 Unknown, 1 Informational, 2 Low, 3 Medium, 4 High, 5 Critical, 6 Fatal, 99 Other) - `severityName` string: OCSF severity name - `statusName` string: Outcome of the activity: Success, Failure, Allowed, Blocked, ... ('' when the source does not say) - `message` string: Human-readable one-line summary of the event - `vendorName` string: Vendor of the product that produced the event - `productName` string: Product that produced the event - `ruleId` string: Detection rule id, when the event is a finding produced by a rule - `ruleName` string: Detection rule name, when the event is a finding - `mitreTactics` string[]: MITRE ATT&CK tactic ids referenced by the event (e.g. TA0006) - `mitreTechniques` string[]: MITRE ATT&CK technique ids referenced by the event (e.g. T1110) - `principalUser` string: Acting user (OCSF actor.user / UDM principal.user) - `principalHost` string: Acting host (OCSF src_endpoint.hostname / UDM principal.hostname) - `principalIp` string: Acting IP address - `principalProcess` string: Acting process (path or command line) - `processName` string: File name of the process the event is about (powershell.exe): in Process Activity the process that was started, otherwise the process that acted - `processPath` string: Full path of that process's executable (Sigma Image) - `processCommandLine` string: That process's command line (Sigma CommandLine) - `parentProcessName` string: File name of the process that started it (explorer.exe) - `parentProcessPath` string: Full path of the parent process's executable (Sigma ParentImage) - `parentProcessCommandLine` string: The parent process's command line (Sigma ParentCommandLine) - `targetUser` string: User the activity was directed at - `targetHost` string: Host the activity was directed at - `targetIp` string: IP address the activity was directed at - `targetPort` number: Port the activity was directed at (0 when not applicable) - `targetResource` string: Resource the activity was directed at (URL, file, ...) - `observables` string[]: Every extracted observable value (users, hosts, IPs, domains, hashes) — powers 'all events mentioning X' queries and the entity-neighborhood graph - `traceId` string: Trace of the request the event happened in, when its source carries one - `spanId` string: Span the event was recorded in, when its source carries one - `sessionId` string: Session the request belonged to: the id its logs, traces and session replay carry - `requestOutcome` string: How far the request behind the event got, as its trace shows: Rejected, Reached App, Errored or Reached Database ('' when it was not followed) - `attributes` object: The full source payload flattened to dot-notation keys with string values - `attributeKeys` string[]: Attribute keys extracted from attributes ## Response `201` Created successfully - object - `data` SecurityEventItemV1ReadSchema - `projectId` string, required: Project ID - `primaryEntityId` string, required: Source ID - `primaryEntityType` string: Source Type - `time` string: Time - `eventUid` string: Event UID - `categoryUid` number: Category UID - `categoryName` string: Category - `classUid` number: Class UID - `className` string: Event Class - `activityName` string: Activity - `severityId` number: Severity ID - `severityName` string: Severity - `statusName` string: Status - `message` string: Message - `vendorName` string: Vendor - `productName` string: Product - `ruleId` string: Rule ID - `ruleName` string: Rule Name - `mitreTactics` string[]: MITRE Tactics - `mitreTechniques` string[]: MITRE Techniques - `principalUser` string: Principal User - `principalHost` string: Principal Host - `principalIp` string: Principal IP - `principalProcess` string: Principal Process - `processName` string: Process - `processPath` string: Process Path - `processCommandLine` string: Command Line - `parentProcessName` string: Parent Process - `parentProcessPath` string: Parent Process Path - `parentProcessCommandLine` string: Parent Command Line - `targetUser` string: Target User - `targetHost` string: Target Host - `targetIp` string: Target IP - `targetPort` number: Target Port - `targetResource` string: Target Resource - `observables` string[]: Observables - `traceId` string: Trace ID - `spanId` string: Span ID - `sessionId` string: Session ID - `requestOutcome` string: Request Outcome - `attributes` string: Attributes - `attributeKeys` string[]: Attribute Keys ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)