Cisco AMP for Endpoints API

GET /v1/computers/user_activity

Description

Query Parameters

Name Type Example Values Description
q String johndoe
limit Integer 5
offset Integer 0

Show Response Fields

Name Type Description
version String
metadata.links.self String
metadata.results.total Integer
metadata.results.current_item_count Integer
metadata.results.index Integer
metadata.results.items_per_page Integer
data Array
data[].connector_guid GUID
data[].hostname String
data[].active Boolean
data[].links.computer String
data[].links.trajectory String
data[].links.group String
Write
Preview

Examples

Fetch list of computers that have observed activity by given user name

Fetch list of computers that have observed activity by given user name

Request

Requires Authorization 
GET /v1/computers/user_activity?q=johndoe&limit=5&offset=0
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED

cURL Edit, then copy and paste on your terminal

curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/computers/user_activity?q=johndoe&limit=5&offset=0'

Response

Actual Response 

strict-transport-security: max-age=31536000
content-type: application/json; charset=utf-8
status: 200 OK
x-ratelimit-limit: 3000
x-ratelimit-reset: 3589
x-ratelimit-remaining: 2978
x-frame-options: SAMEORIGIN
x-ratelimit-resetdate: 2020-02-20T19:42:33Z
transfer-encoding: chunked

{
  "version": "v1.2.0",
  "metadata": {
    "links": {
      "self": "https://api.eu.amp.cisco.com/v1/computers/user_activity?q=johndoe&limit=5&offset=0"
    },
    "results": {
      "total": 5,
      "current_item_count": 5,
      "index": 0,
      "items_per_page": 5
    }
  },
  "data": [
    {
      "connector_guid": "3e2cd1ab-1f23-4ee9-a787-c2b4a33e3d19",
      "hostname": "Demo_Qakbot_3",
      "active": true,
      "links": {
        "computer": "https://api.eu.amp.cisco.com/v1/computers/3e2cd1ab-1f23-4ee9-a787-c2b4a33e3d19",
        "trajectory": "https://api.eu.amp.cisco.com/v1/computers/3e2cd1ab-1f23-4ee9-a787-c2b4a33e3d19/user_trajectory?q=johndoe",
        "group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
      }
    },
    {
      "connector_guid": "552c40f8-afc1-4eae-85cf-b70c9644a3fe",
      "hostname": "Demo_Qakbot_1",
      "active": true,
      "links": {
        "computer": "https://api.eu.amp.cisco.com/v1/computers/552c40f8-afc1-4eae-85cf-b70c9644a3fe",
        "trajectory": "https://api.eu.amp.cisco.com/v1/computers/552c40f8-afc1-4eae-85cf-b70c9644a3fe/user_trajectory?q=johndoe",
        "group": "https://api.eu.amp.cisco.com/v1/groups/b077d6bc-bbdf-42f7-8838-a06053fbd98a"
      }
    },
    {
      "connector_guid": "aa450051-7dfc-48a5-b44d-835056ca317b",
      "hostname": "Demo_WannaCry_Ransomware",
      "active": true,
      "links": {
        "computer": "https://api.eu.amp.cisco.com/v1/computers/aa450051-7dfc-48a5-b44d-835056ca317b",
        "trajectory": "https://api.eu.amp.cisco.com/v1/computers/aa450051-7dfc-48a5-b44d-835056ca317b/user_trajectory?q=johndoe",
        "group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
      }
    },
    {
      "connector_guid": "aed73261-ff22-40aa-837e-b6943a7a3249",
      "hostname": "Demo_AMP_Threat_Quarantined",
      "active": false,
      "links": {
        "computer": "https://api.eu.amp.cisco.com/v1/computers/aed73261-ff22-40aa-837e-b6943a7a3249",
        "trajectory": "https://api.eu.amp.cisco.com/v1/computers/aed73261-ff22-40aa-837e-b6943a7a3249/user_trajectory?q=johndoe",
        "group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
      }
    },
    {
      "connector_guid": "d559505b-0ae9-4089-b5fa-0f7f44326ef0",
      "hostname": "Demo_Qakbot_2",
      "active": true,
      "links": {
        "computer": "https://api.eu.amp.cisco.com/v1/computers/d559505b-0ae9-4089-b5fa-0f7f44326ef0",
        "trajectory": "https://api.eu.amp.cisco.com/v1/computers/d559505b-0ae9-4089-b5fa-0f7f44326ef0/user_trajectory?q=johndoe",
        "group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
      }
    }
  ]
}