--- title: "# Action Details List" method: GET path: "/v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions" tags: ["Simulation-Result"] --- # # Action Details List `GET /v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions` ## Request - Base URL: `https://api.picussecurity.com` - URL: `https://api.picussecurity.com/v1/simulations/{Id}/run/{RunId}/threats/{ThreatId}/actions` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Includes detailed action result with attack start & end time, log & alert time and attack module based details (payloads, terminal log, file name, sha256, md5, sha1) for the actions of the given threat. Protocol based results are also available. Includes detection rules mapped to each action under `detection_contents`, grouped by content source. Only sources the account is licensed for appear, and only rule ids the account may fetch. To retrieve a rule, call GET /v1/mitigation/detection-content/{source}/rules/{rule_id} with the entry's `source_name` as {source} — that endpoint resolves sources by name, so `source_id` is not accepted there. Omitted when the account has no detection-content license or no rules map to the action. ## Path parameters - `Id` integer, required - `RunId` integer, required - `ThreatId` integer, required ## Query parameters - `limit` integer - `offset` integer - `action_ids` integer[] - `action_display_ids` integer[] ## Response `200` ActionDetailsListReturnSwagger - object - `actions` ActionDetailsDTO[] - `action_id` integer: Action Id - `action_name` string: Action Name - `affected_os` string[]: Affected Os - `affected_platforms` PlatformCommon[]: Affected Platforms - `architecture` string - `os` string - `platform` string - `affected_products` string[]: Affected Products - `attack_module` string: Attack Module - `attack_module_id` integer: Attack Module Id - `category` string: Category - `completed_at` integer: Completed At - `description` string: Description - `detection_analysis` DetectionResult - `alert_result` string: Alert result Alerted / Not Alerted - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has Log analysis - `integration_based_results` IntegrationBasedResult[] - `alert` Alert - `alert_result` string: Alert Result Alerted / Not Alerted - `alerted_time` integer: Alerted time if it is alerted - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integration_id` integer: Integration Id - `log` Logging - `log_result` string: Log Result Logged / Not Logged - `logged_time` integer: Logged time if it is Logged - `product_name` string: Product name - `protocol` string: Protocol like http / https - `status` string: Status - `log_result` string: Log result Logged / Not Logged - `detection_contents` ActionDetectionContentDTO[]: Detection rules mapped to this action, grouped by content source. Only sources the account is licensed for appear, and only rule ids it may fetch via /v1/mitigation/detection-content/{source_name}/rules/{rule_id}. Omitted when the account holds no detection-content license, when no rules map to the action, or when the lookup is unavailable. - `rule_ids` string[]: Detection rule ids for this action under this source - `source_id` integer: Content source id, matching GET /v1/mitigation/detection-content/devices. Correlation only — the rules endpoint resolves sources by name, so use SourceName, not this, when fetching a rule. - `source_name` string: Content source name — the device's own name, as listed by GET /v1/mitigation/detection-content/devices and accepted as {source} by GET /v1/mitigation/detection-content/{source}/rules/{rule_id}. The sources listing reports a generalized vendor name instead, so the two can differ. - `display_id` integer: Display Id (Seen in UI) - `frameworks` Frameworks - `mitre` Mitre - `sub_technique` string: Mitre Att&ck SubTechnique Name - `sub_technique_id` string: Mitre Att&ck SubTechnique Id - `tactic` string: Mitre Att&ck Tactic Name - `tactic_id` string: Mitre Att&ck Tactic Id - `technique` string: Mitre Att&ck Technique Name - `technique_id` string: Mitre Att&ck Technique Id - `ukc` Ukc - `phase` string: Unified kill chain Phase - `stage` string: Unified kill chain SÏtage - `has_detection_analysis` boolean: Has detection analysis - `module_based_results` ModuleBasedResults - `file_details` FileDetailsCommon[] - `md5` string - `name` string - `sha1` string - `sha256` string - `process_results` ActionDetailProcess[] - `command` string: Command - `id` integer: Process Id - `log_content` string: Log Content - `name` string: Process Name - `node_id` integer: Node Id (One action can be in the same threat, it can be specified with node id) - `owasp` string: Owasp - `prevention` string: Prevention Result - `protocol_based_result` ProtocolBasedResults[] - `alert_result` string: Alert result if it has alert analysis - `completed_at` integer: Completed at - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integrations` PIntegrationBasedResult[] - `action_id` integer - `alert_result` string: Alert result if it has alert analysis - `has_alert_analysis` boolean: Has alert analysis - `has_log_analysis` boolean: Has log analysis - `integration_id` integer: Integration Identifier - `log_result` string: Log result if it has log analysis - `node_id` integer - `product_name` string: Integrated Product Name - `protocol` string: Protocol http / https - `log_result` string: Log result if it has log analysis - `prevention` string: Prevention result - `protocol` string: Protocol http / https - `started_at` integer: Started at - `references` ActionDetailReferences - `cve_reference` Reference - `link` string: Link - `name` string: Name - `cwe_reference` Reference - `link` string: Link - `name` string: Name - `virus_total_reference` Reference[] - `link` string: Link - `name` string: Name - `sources` string[]: Sources - `started_at` integer: Started At - `pages` Pagination - `limit` integer: Limit - `offset` integer: Offset - `total_count` integer: Total Count ## Other responses - `422`: validationErrorSwagger is represents the erroneous cases - `default`: genericErrorSwagger is represents the erroneous cases --- [API](https://skmtc.dev/picussecurity/apis/picus-rest-api.md) - [All operations](https://skmtc.dev/picussecurity/apis/picus-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/picussecurity/apis/picus-rest-api/revisions/319e45a98304?raw)