--- title: "# Action Details" method: GET path: "/v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions/{ActionId}" tags: ["Simulation-Result"] --- # # Action Details `GET /v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions/{ActionId}` ## Request - Base URL: `https://api.picussecurity.com` - URL: `https://api.picussecurity.com/v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions/{ActionId}` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1). Protocol based results are also available. Includes detection rules mapped to each action under `detection_contents`, grouped by content source. Only sources the account is licensed for appear, and only rule ids the account may fetch. To retrieve a rule, call GET /v1/mitigation/detection-content/{source}/rules/{rule_id} with the entry's `source_name` as {source} — that endpoint resolves sources by name, so `source_id` is not accepted there. Omitted when the account has no detection-content license or no rules map to the action. ## Path parameters - `RunId` integer, required - `ActionId` integer, required - `Id` integer, required - `ThreatId` integer, required ## Query parameters - `node_id` integer ## Response `200` ActionDetailsReturnSwagger - object - `action_id` integer: Action Id - `action_name` string: Action Name - `affected_os` string[]: Affected Os - `affected_platforms` PlatformCommon[]: Affected Platforms - `architecture` string - `os` string - `platform` string - `affected_products` string[]: Affected Products - `attack_module` string: Attack Module - `attack_module_id` integer: Attack Module Id - `category` string: Category - `completed_at` integer: Completed At - `description` string: Description - `detection_analysis` DetectionResult - `alert_result` string: Alert result Alerted / Not Alerted - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has Log analysis - `integration_based_results` IntegrationBasedResult[] - `alert` Alert - `alert_result` string: Alert Result Alerted / Not Alerted - `alerted_time` integer: Alerted time if it is alerted - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integration_id` integer: Integration Id - `log` Logging - `log_result` string: Log Result Logged / Not Logged - `logged_time` integer: Logged time if it is Logged - `product_name` string: Product name - `protocol` string: Protocol like http / https - `status` string: Status - `log_result` string: Log result Logged / Not Logged - `detection_contents` ActionDetectionContentDTO[]: Detection rules mapped to this action, grouped by content source. Only sources the account is licensed for appear, and only rule ids it may fetch via /v1/mitigation/detection-content/{source_name}/rules/{rule_id}. Omitted when the account holds no detection-content license, when no rules map to the action, or when the lookup is unavailable. - `rule_ids` string[]: Detection rule ids for this action under this source - `source_id` integer: Content source id, matching GET /v1/mitigation/detection-content/devices. Correlation only — the rules endpoint resolves sources by name, so use SourceName, not this, when fetching a rule. - `source_name` string: Content source name — the device's own name, as listed by GET /v1/mitigation/detection-content/devices and accepted as {source} by GET /v1/mitigation/detection-content/{source}/rules/{rule_id}. The sources listing reports a generalized vendor name instead, so the two can differ. - `display_id` integer: Display Id (Seen in UI) - `frameworks` Frameworks - `mitre` Mitre - `sub_technique` string: Mitre Att&ck SubTechnique Name - `sub_technique_id` string: Mitre Att&ck SubTechnique Id - `tactic` string: Mitre Att&ck Tactic Name - `tactic_id` string: Mitre Att&ck Tactic Id - `technique` string: Mitre Att&ck Technique Name - `technique_id` string: Mitre Att&ck Technique Id - `ukc` Ukc - `phase` string: Unified kill chain Phase - `stage` string: Unified kill chain SÏtage - `has_detection_analysis` boolean: Has detection analysis - `module_based_results` ModuleBasedResults - `file_details` FileDetailsCommon[] - `md5` string - `name` string - `sha1` string - `sha256` string - `process_results` ActionDetailProcess[] - `command` string: Command - `id` integer: Process Id - `log_content` string: Log Content - `name` string: Process Name - `node_id` integer: Node Id (One action can be in the same threat, it can be specified with node id) - `owasp` string: Owasp - `prevention` string: Prevention Result - `protocol_based_result` ProtocolBasedResults[] - `alert_result` string: Alert result if it has alert analysis - `completed_at` integer: Completed at - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integrations` PIntegrationBasedResult[] - `action_id` integer - `alert_result` string: Alert result if it has alert analysis - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integration_id` integer: Integration Identifier - `log_result` string: Log result if it has log analysis - `node_id` integer - `product_name` string: Integrated Product Name - `protocol` string: Protocol http / https - `log_result` string: Log result if it has log analysis - `prevention` string: Prevention result - `protocol` string: Protocol http / https - `started_at` integer: Started at - `references` ActionDetailReferences - `cve_reference` Reference - `link` string: Link - `name` string: Name - `cwe_reference` Reference - `link` string: Link - `name` string: Name - `virus_total_reference` Reference[] - `link` string: Link - `name` string: Name - `sources` string[]: Sources - `started_at` integer: Started At ## Other responses - `422`: validationErrorSwagger is represents the erroneous cases - `default`: genericErrorSwagger is represents the erroneous cases --- [API](https://skmtc.dev/picussecurity/apis/picus-rest-api.md) - [All operations](https://skmtc.dev/picussecurity/apis/picus-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/picussecurity/apis/picus-rest-api/revisions/319e45a98304?raw)