GET /v0/computers/activity
Description
This endpoint provides you with the ability to search all computers across your organization for any events or activities associated with a file or network operation, and returns computers matching that criteria. You can then query the /computers/{connector-guid}/trajectory endpoint for specific details.
This endpoint requires a q parameter which is a freeform query string. It currently accepts:
- an IPv4 address: 1.0.0.0. Note for this search CIDR addresses are not supported
- a SHA256
- a filename
- a URL fragment
There is a hard limit of 5000 historical entries searched for this endpoint.
Query Parameters
Name | Type | Example Values | Description |
---|---|---|---|
q |
String | SearchProtocolHost.exe, 814a37d89a79aa3975308e723bc1a3a67360323b7e3584de00896fe7c59bbb8e, 75.102.25.76, sovereutilizeignty.com | |
limit |
Integer | 5 | |
offset |
Integer | 0 |
Name | Type | Description |
---|---|---|
version | String | |
metadata.links.self | String | |
metadata.results.total | Integer | |
metadata.results.current_item_count | Integer | |
metadata.results.index | Integer | |
metadata.results.items_per_page | Integer | |
data | Array | |
data[].connector_guid | GUID | |
data[].hostname | String | |
data[].active | Boolean | |
data[].links.computer | String | |
data[].links.trajectory | String | |
data[].links.group | String |
Examples
- Fetch list of computers that have observed files with given file name
- Fetch list of computers that have observed files with given SHA-256 value
- Fetch list of computers that have connected to a given IP address
- Fetch list of computers that have connected to a given URL
Fetch list of computers that have observed files with given file name
Request
Requires AuthorizationGET /v0/computers/activity?q=SearchProtocolHost.exe&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.consumer.amp.cisco.com/v0/computers/activity?q=SearchProtocolHost.exe&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.consumer.amp.cisco.com/v0/computers/activity?q=SearchProtocolHost.exe&limit=5'
Actual Response
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 905 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2875 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"9ec77f9192d521bbb392ecf236f80f0b" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v0.2.2",
"metadata": {
"links": {
"self": "https://api.consumer.amp.cisco.com/v0/computers/activity?q=SearchProtocolHost.exe&limit=5"
},
"results": {
"total": 3,
"current_item_count": 3,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"connector_guid": "23bd9cb5-382d-44e3-89fc-e57e94ede4ce",
"hostname": "Demo_Command_Line_Arguments_Kovter",
"windows_processor_id": "b49f5a16e387d20",
"active": false,
"links": {
"group": "https://api.consumer.amp.cisco.com/v0/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
{
"connector_guid": "afd12048-34bc-483f-9149-4656d5d53097",
"hostname": "Demo_CozyDuke",
"windows_processor_id": "fd3674b205981ea",
"active": false,
"links": {
"group": "https://api.consumer.amp.cisco.com/v0/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
{
"connector_guid": "c21492b4-f47a-4424-ad68-9b956b36debb",
"hostname": "Demo_Upatre",
"windows_processor_id": "8d3ba4196f2e075",
"active": false,
"links": {
"group": "https://api.consumer.amp.cisco.com/v0/groups/b077d6bc-bbdf-42f7-8838-a06053fbd98a"
}
}
]
}
Fetch list of computers that have observed files with given SHA-256 value
Request
Requires AuthorizationGET /v0/computers/activity?q=814a37d89a79aa3975308e723bc1a3a67360323b7e3584de00896fe7c59bbb8e&offset=0&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.consumer.amp.cisco.com/v0/computers/activity?q=814a37d89a79aa3975308e723bc1a3a67360323b7e3584de00896fe7c59bbb8e&offset=0&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.consumer.amp.cisco.com/v0/computers/activity?q=814a37d89a79aa3975308e723bc1a3a67360323b7e3584de00896fe7c59bbb8e&offset=0&limit=5'
Actual Response
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 905 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2874 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"76ef0897981a174d06d9209ec4695966" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v0.2.2",
"metadata": {
"links": {
"self": "https://api.consumer.amp.cisco.com/v0/computers/activity?q=814a37d89a79aa3975308e723bc1a3a67360323b7e3584de00896fe7c59bbb8e&offset=0&limit=5"
},
"results": {
"total": 0,
"current_item_count": 0,
"index": 0,
"items_per_page": 5
}
},
"data": [
]
}
Fetch list of computers that have connected to a given IP address
Request
Requires AuthorizationGET /v0/computers/activity?q=75.102.25.76&offset=0&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.consumer.amp.cisco.com/v0/computers/activity?q=75.102.25.76&offset=0&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.consumer.amp.cisco.com/v0/computers/activity?q=75.102.25.76&offset=0&limit=5'
Actual Response
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 905 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2873 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"60ec931f57300138be8e5c85c3ba4370" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v0.2.2",
"metadata": {
"links": {
"self": "https://api.consumer.amp.cisco.com/v0/computers/activity?q=75.102.25.76&offset=0&limit=5"
},
"results": {
"total": 1,
"current_item_count": 1,
"index": 0,
"items_per_page": 5
}
},
"data": [
{
"connector_guid": "c21492b4-f47a-4424-ad68-9b956b36debb",
"hostname": "Demo_Upatre",
"windows_processor_id": "8d3ba4196f2e075",
"active": false,
"links": {
"group": "https://api.consumer.amp.cisco.com/v0/groups/b077d6bc-bbdf-42f7-8838-a06053fbd98a"
}
}
]
}
Fetch list of computers that have connected to a given URL
Request
Requires AuthorizationGET /v0/computers/activity?q=sovereutilizeignty.com&offset=0&limit=5
Headers
accept: application/json
content-type: application/json
accept-encoding: identity
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
-H 'accept-encoding: identity' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.consumer.amp.cisco.com/v0/computers/activity?q=sovereutilizeignty.com&offset=0&limit=5'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ -H 'accept-encoding: identity' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.consumer.amp.cisco.com/v0/computers/activity?q=sovereutilizeignty.com&offset=0&limit=5'
Actual Response
content-type: application/json transfer-encoding: chunked status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 905 strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000 referrer-policy: strict-origin-when-cross-origin x-ratelimit-remaining: 2872 x-permitted-cross-domain-policies: none x-download-options: noopen etag: W/"69bbed221dc0109815f2cad466e3e4ec" x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2022-03-18T11:55:11Z
{
"version": "v0.2.2",
"metadata": {
"links": {
"self": "https://api.consumer.amp.cisco.com/v0/computers/activity?q=sovereutilizeignty.com&offset=0&limit=5"
},
"results": {
"total": 0,
"current_item_count": 0,
"index": 0,
"items_per_page": 5
}
},
"data": [
]
}