WAwatchguard

Retrieve risks detected for devices.

Retrieves a count of risks detected on each device by risk level. The response to this request is limited to 3,000 records.

get/api/v1/accounts/{accountId}/riskassessment/devicesrisk

Request

Path parameters

accountIdstring required

Your WatchGuard Cloud account ID.

Query parameters

topinteger

Specifies the number of objects to retrieve (there is a maximum supported by the server).

skipinteger

Bypasses the specified number of objects in the results returned.

searchstring

Returns only objects that include the specified text string. The supported search field is the device host name

countboolean

Indicates whether to return a counter that shows the total number of objects in the total_items response parameter.

filterstring
Example:Retrieves Linux laptops devices: 4005%20Eq%202%20And%204004%20Eq%202 Retrieves devices for the last 7 days: 9001%20AmongTheLast%20[7,3]

Specifies a filter to retrieve devices. You can combine two or more values with the boolean operators %20And%20 and %20Or%20.

  • 4005%20Eq%20{DeviceTypeEnum} where {DeviceTypeEnum} => 1=Workstation, 2=Laptop, 3=Server, 4=Mobile
  • 4004%20Eq%20{PlatformEnum} where {PlatformEnum} => 1=Windows, 2=Linux, 3=Mac, 4=Android, 5=Ios
  • 72001%20Eq%20{RiskLevel} where {RiskLevel} => 5=No risk, 20=Medium, 30=High, 40=Critical
  • 72002%20Eq%20{DetectedRiskFactor} where {DetectedRiskFactor} => 10=No protection, 20=Out-of-date protection, 30=Out-of-date knowledge (more than 30 days), 40=No connectivity to knowledge servers, 50=No uninstallation protection, 60=Anti-tamper protection disabled, 70=File antivirus disabled, 80=Advanced protection for Windows disabled or in ‘Audit’ mode, 90=Advanced protection for Windows in ‘Hardening’ mode, 100=Advanced protection for Linux disabled or in 'Do not detect’ or ‘Audit’ mode, 110=Anti-exploit protection disabled or in 'Audit' mode, 120=Anti-phishing protection disabled, 130=Web browsing antivirus disabled, 140=Folder, file, and extension exclusions, 150=Recent indicators of attack, 160=Critical patches pending installation, 170=Audit mode enabled, 180=Network attack protection disabled or in 'Audit' mode
  • 9001%20AmongTheLast%20[24,4] -> Last 24h
  • 9001%20AmongTheLast%20[3,3] -> Last 3 days
  • 9001%20AmongTheLast%20[7,3] -> Last 7 days
  • 9001%20AmongTheLast%20[30,3] -> Last 30 days
  • 9001%20NotAmongTheLast%20[3,3] -> More than 72h ago
  • 9001%20NotAmongTheLast%20[7,3] -> More than 7 days
  • 9001%20NotAmongTheLast%20[30,3] -> More than 30 days

Response

OK

total_itemsinteger nullable

Optionally, if Count parameter is provided, we return here the total number of items

Example response

{
  "data": {
    "host_name": "WIN_SERVER_10",
    "device_id": "123456d8-910f-4f5a-a7ad-e2480d5ad155",
    "last_connection_date": "2022-10-14T12:00:00Z"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.