SUsublime
Message Groups

Get SIEM-oriented summary of flagged message groups

Changed on

Returns a paginated, reduced-field summary of flagged message groups intended for SIEM ingestion. Array fields are bounded to keep payloads under typical SIEM batch limits.

get/v0/message-groups/siem-summary

Request

  • Base URL
    https://platform.sublime.security
  • URL
    https://platform.sublime.security/v0/message-groups/siem-summary
  • Auth
    HTTP bearer

Query parameters

cursorstring nullable

Opaque pagination cursor returned in the previous response's cursor field.

limitinteger

The maximum number of message groups to return.

timestamp__gtestring date-time nullable

Inclusive lower bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).

timestamp__ltstring date-time nullable

Exclusive upper bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).

type'flagged' | 'reported'

Which timestamp the endpoint sorts/filters on: 'flagged' uses newest_created_at, 'reported' uses first_reported_as_phish_at.

Response

OK

cursorstring nullable

Opaque cursor for the next page; pass it back as the cursor query param. Null when no more pages are available.

truncatedboolean

Whether pagination stopped because the crawl reached the per-crawl result budget rather than exhausting the requested window. To retrieve the remainder, re-request with timestamp__lt set just above the last item's last_seen (type=flagged) or first_reported_as_phish_at (type=reported) and deduplicate by id: timestamp__lt is exclusive and has no canonical_id tiebreaker, so groups sharing the boundary timestamp are otherwise skipped.

Changes

  • 081203bd7147Revision changes
    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status