GET /v1/events
Description
This is a general query interface for events. This is analogous to the Events view on the FireAMP Console.
Events can be filtered by a variety of criteria. Each criteria type is logically ANDed with the other criteria; each selection of a criteria is logically ORed. For example: with the query string: connector_guid[]=ead39d47-93bd-4230-b692-454b433faf96&event_type[]=2164260868&event_type[]=1090519054
, it will return any events that match the connector guid ad39d47-93bd-4230-b692-454b433faf96 AND any events with type (1090519054 OR 2164260868).
The arguments passed to the event_type
and group_guid
parameters can be retrieved from their respective endpoints.
Query Parameters
Name | Type | Example Values | Description |
---|---|---|---|
limit |
Integer | 2, 1, 10 | |
detection_sha256 |
String | f8a6a244138cb1e2f044f63f3dc42beeb555da892bbd7a121274498cbdfc9ad5 | |
application_sha256 |
String | 80ef843fa78c33b511394a9c7535a9cbace1deb2270e86ee4ad2faffa5b1e7d2 | |
connector_guid[] |
GUID | af73d9d5-ddc5-4c93-9c6d-d5e6b5c5eb01 | |
group_guid[] |
GUID | b077d6bc-bbdf-42f7-8838-a06053fbd98a | |
start_date |
String (Time ISO8601) | 2015-10-01T00:00:00+00:00 | Inclusive (The list will include events that match start_date) |
offset |
Integer | 10 | |
event_type[] |
Array | 1090519054, 1090519084 |
Name | Type | Description |
---|---|---|
version | String | |
metadata.links.self | String | |
metadata.links.prev | String | |
metadata.links.next | String | |
metadata.results.total | Integer | |
metadata.results.current_item_count | Integer | |
metadata.results.index | Integer | |
metadata.results.items_per_page | Integer | |
data | Array | |
data[].id | Integer | |
data[].timestamp | Integer | |
data[].timestamp_nanoseconds | Integer | |
data[].date | String (Time ISO8601) | |
data[].event_type | String | |
data[].event_type_id | Integer | |
data[].detection | String | |
data[].detection_id | String | |
data[].group_guids | Array | |
data[].group_guids[] | GUID | |
data[].computer.connector_guid | GUID | |
data[].computer.hostname | String | |
data[].computer.external_ip | String | |
data[].computer.user | String | |
data[].computer.active | Boolean | |
data[].computer.network_addresses | Array | |
data[].computer.network_addresses[].ip | String | |
data[].computer.network_addresses[].mac | String | |
data[].computer.links.computer | String | |
data[].computer.links.trajectory | String | |
data[].computer.links.group | String | |
data[].file.disposition | String | |
data[].file.file_name | String | |
data[].file.file_path | String | |
data[].file.identity.sha256 | String | |
data[].file.identity.sha1 | String | |
data[].file.identity.md5 | String | |
data[].file.parent.process_id | Integer | |
data[].file.parent.disposition | String | |
data[].file.parent.file_name | String | |
data[].file.parent.identity.sha256 | String | |
data[].file.parent.identity.sha1 | String | |
data[].file.parent.identity.md5 | String | |
data[].scan.description | String |
Examples
- Fetch list of events sorted in descending order by timestamp
- Fetch list of events filtered by connector_guid
- Fetch list of events filtered by group_guid
- Fetch list of events filtered by detection_sha256
- Fetch list of events filtered by application_sha256
- Fetch list of events filtered by detection_sha256 and application_sha256
- Fetch list of events filtered by event_type
- Fetch events that are newer than a given timestamp
- Fetch list of events filtered by SCAN_STARTED event type
Fetch list of events sorted in descending order by timestamp
Request
Requires AuthorizationGET /v1/events?limit=2
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?limit=2'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?limit=2'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3556 x-ratelimit-remaining: 2938 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?limit=2",
"next": "https://api.eu.amp.cisco.com/v1/events?limit=2&offset=2"
},
"results": {
"total": 3209,
"current_item_count": 2,
"index": 0,
"items_per_page": 2
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
},
{
"id": 6180351977805840000,
"timestamp": 1574446806,
"timestamp_nanoseconds": 548000000,
"date": "2019-11-22T18:20:06+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180351977805840385",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by connector_guid
Request
Requires AuthorizationGET /v1/events?connector_guid[]=20a0ce9f-44d1-4cbb-ab04-8a0705448b72&limit=1
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?connector_guid[]=20a0ce9f-44d1-4cbb-ab04-8a0705448b72&limit=1'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?connector_guid[]=20a0ce9f-44d1-4cbb-ab04-8a0705448b72&limit=1'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3554 x-ratelimit-remaining: 2937 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?connector_guid[]=20a0ce9f-44d1-4cbb-ab04-8a0705448b72&limit=1",
"next": "https://api.eu.amp.cisco.com/v1/events?connector_guid%5B%5D=20a0ce9f-44d1-4cbb-ab04-8a0705448b72&limit=1&offset=1"
},
"results": {
"total": 170,
"current_item_count": 1,
"index": 0,
"items_per_page": 1
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by group_guid
Request
Requires AuthorizationGET /v1/events?group_guid[]=6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03&limit=1
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?group_guid[]=6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03&limit=1'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?group_guid[]=6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03&limit=1'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3550 x-ratelimit-remaining: 2936 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?group_guid[]=6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03&limit=1",
"next": "https://api.eu.amp.cisco.com/v1/events?group_guid%5B%5D=6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03&limit=1&offset=1"
},
"results": {
"total": 1129,
"current_item_count": 1,
"index": 0,
"items_per_page": 1
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by detection_sha256
Request
Requires AuthorizationGET /v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&limit=1
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&limit=1'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&limit=1'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3548 x-ratelimit-remaining: 2935 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&limit=1",
"next": "https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&limit=1&offset=1"
},
"results": {
"total": 10,
"current_item_count": 1,
"index": 0,
"items_per_page": 1
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by application_sha256
Request
Requires AuthorizationGET /v1/events?application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3545 x-ratelimit-remaining: 2934 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1",
"next": "https://api.eu.amp.cisco.com/v1/events?application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1&offset=1"
},
"results": {
"total": 70,
"current_item_count": 1,
"index": 0,
"items_per_page": 1
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by detection_sha256 and application_sha256
Request
Requires AuthorizationGET /v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3543 x-ratelimit-remaining: 2933 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1",
"next": "https://api.eu.amp.cisco.com/v1/events?detection_sha256=b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40&application_sha256=b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132&limit=1&offset=1"
},
"results": {
"total": 10,
"current_item_count": 1,
"index": 0,
"items_per_page": 1
}
},
"data": [
{
"id": 6180352115244794000,
"timestamp": 1574446838,
"timestamp_nanoseconds": 279000000,
"date": "2019-11-22T18:20:38+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "W32.GenericKD:ZVETJ.18gs.1201",
"detection_id": "6180352115244793858",
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "Medium",
"computer": {
"connector_guid": "20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"hostname": "Demo_Upatre",
"external_ip": "69.226.122.127",
"user": "A@TEMPLATE-W7X86",
"active": true,
"network_addresses": [
{
"ip": "230.122.135.241",
"mac": "3f:1e:b2:28:25:24"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/20a0ce9f-44d1-4cbb-ab04-8a0705448b72/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"file_name": "wsymqyv90.exe",
"file_path": "\\\\?\\C:\\Users\\Administrator\\AppData\\Local\\Temp\\OUTLOOK_TEMP\\wsymqyv90.exe",
"identity": {
"sha256": "b630e72639cc7340620adb0cfc26332ec52fe8867b769695f2d25718d68b1b40",
"sha1": "70aef829bec17195e6c8ec0e6cba0ed39f97ba48",
"md5": "e2f5dcd966e26d54329e8d79c7201652"
},
"parent": {
"process_id": 4040,
"disposition": "Clean",
"file_name": "iexplore.exe",
"identity": {
"sha256": "b4e5c2775de098946b4e11aba138b89d42b88c1dbd4d5ec879ef6919bf018132",
"sha1": "8de30174cebc8732f1ba961e7d93fe5549495a80",
"md5": "b3581f426dc500a51091cdd5bacf0454"
}
}
}
}
]
}
Fetch list of events filtered by event_type
Request
Requires AuthorizationGET /v1/events?event_type[]=1090519054&event_type[]=1090519084&offset=10&limit=10
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?event_type[]=1090519054&event_type[]=1090519084&offset=10&limit=10'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?event_type[]=1090519054&event_type[]=1090519084&offset=10&limit=10'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3543 x-ratelimit-remaining: 2932 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?event_type[]=1090519054&event_type[]=1090519084&offset=10&limit=10",
"prev": "https://api.eu.amp.cisco.com/v1/events?event_type%5B%5D=1090519054&event_type%5B%5D=1090519084&limit=10&offset=0",
"next": "https://api.eu.amp.cisco.com/v1/events?event_type%5B%5D=1090519054&event_type%5B%5D=1090519084&limit=10&offset=20"
},
"results": {
"total": 2264,
"current_item_count": 10,
"index": 10,
"items_per_page": 10
}
},
"data": [
{
"id": 6176259234750005000,
"timestamp": 1574443093,
"timestamp_nanoseconds": 657000000,
"date": "2019-11-22T17:18:13+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "GenericKD:Dyreza-tpd",
"detection_id": "6176259234750005342",
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"group_guids": [
"68665863-74d5-4bc1-ac7f-5477b2b6406e"
],
"severity": "Medium",
"computer": {
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"hostname": "Demo_Dyre",
"external_ip": "16.115.4.195",
"active": true,
"network_addresses": [
{
"ip": "63.14.206.143",
"mac": "05:29:bc:4f:91:4f"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
}
},
"file": {
"disposition": "Malicious",
"file_name": "webinstall.exe",
"file_path": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\webinstall.exe",
"identity": {
"sha256": "4fe85509bb6a87dbf04aa114c5523b183f995a6820f424871df29bca64ad7ecc",
"sha1": "ec80314ae4a2817be806b7ae27dbdb31a88226a0",
"md5": "e9d8c15e7d18678dd41771f72ed6693c"
}
}
},
{
"id": 6176259183210398000,
"timestamp": 1574443081,
"timestamp_nanoseconds": 645000000,
"date": "2019-11-22T17:18:01+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "GenericKD:Dyreza-tpd",
"detection_id": "6176259183210397789",
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"group_guids": [
"68665863-74d5-4bc1-ac7f-5477b2b6406e"
],
"severity": "Medium",
"computer": {
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"hostname": "Demo_Dyre",
"external_ip": "16.115.4.195",
"active": true,
"network_addresses": [
{
"ip": "63.14.206.143",
"mac": "05:29:bc:4f:91:4f"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
}
},
"file": {
"disposition": "Malicious",
"file_name": "webinstall.exe",
"file_path": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\webinstall.exe",
"identity": {
"sha256": "4fe85509bb6a87dbf04aa114c5523b183f995a6820f424871df29bca64ad7ecc",
"sha1": "ec80314ae4a2817be806b7ae27dbdb31a88226a0",
"md5": "e9d8c15e7d18678dd41771f72ed6693c"
}
}
}
]
}
Fetch events that are newer than a given timestamp
Request
Requires AuthorizationGET /v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&offset=10&limit=10
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&offset=10&limit=10'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&offset=10&limit=10'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3543 x-ratelimit-remaining: 2931 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&offset=10&limit=10",
"prev": "https://api.eu.amp.cisco.com/v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&limit=10&offset=0",
"next": "https://api.eu.amp.cisco.com/v1/events?start_date=2015-10-01T00%3A00%3A00%2B00%3A00&limit=10&offset=20"
},
"results": {
"total": 3389,
"current_item_count": 10,
"index": 10,
"items_per_page": 10
}
},
"data": [
{
"id": 1489955900329000200,
"timestamp": 1574443498,
"timestamp_nanoseconds": 329000000,
"date": "2019-11-22T17:24:58+00:00",
"event_type": "Potential Dropper Infection",
"event_type_id": 1107296258,
"detection": "W32.3372C1EDAB-100.SBX.TG",
"connector_guid": "9dbe7029-2385-4a24-8ddc-39fccc17ce0f",
"group_guids": [
"6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
],
"severity": "High",
"start_timestamp": 1574443498,
"start_date": "2019-11-22T17:24:58+00:00",
"computer": {
"connector_guid": "9dbe7029-2385-4a24-8ddc-39fccc17ce0f",
"hostname": "Demo_TeslaCrypt",
"external_ip": "120.138.22.84",
"active": true,
"network_addresses": [
{
"ip": "104.138.81.103",
"mac": "24:66:d7:6e:9a:07"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/9dbe7029-2385-4a24-8ddc-39fccc17ce0f",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/9dbe7029-2385-4a24-8ddc-39fccc17ce0f/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/6c3c2005-4c74-4ba7-8dbb-c4d5b6bafe03"
}
},
"file": {
"disposition": "Malicious",
"identity": {
"sha256": "3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370"
},
"parent": {
"disposition": "Blocklisted",
"identity": {
"sha256": "9e1ec8b43a88e68767fd8fed2f38e7984357b3f4186d0f907e62f8b6c9ff56ad"
}
}
}
},
{
"id": 6176259286289613000,
"timestamp": 1574443105,
"timestamp_nanoseconds": 669000000,
"date": "2019-11-22T17:18:25+00:00",
"event_type": "Threat Detected",
"event_type_id": 1090519054,
"detection": "GenericKD:Dyreza-tpd",
"detection_id": "6176259286289612895",
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"group_guids": [
"68665863-74d5-4bc1-ac7f-5477b2b6406e"
],
"severity": "Medium",
"computer": {
"connector_guid": "ea892128-4769-4ed9-86c2-6d1c97b7c273",
"hostname": "Demo_Dyre",
"external_ip": "16.115.4.195",
"active": true,
"network_addresses": [
{
"ip": "63.14.206.143",
"mac": "05:29:bc:4f:91:4f"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/ea892128-4769-4ed9-86c2-6d1c97b7c273/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
}
},
"file": {
"disposition": "Malicious",
"file_name": "webinstall.exe",
"file_path": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\webinstall.exe",
"identity": {
"sha256": "4fe85509bb6a87dbf04aa114c5523b183f995a6820f424871df29bca64ad7ecc",
"sha1": "ec80314ae4a2817be806b7ae27dbdb31a88226a0",
"md5": "e9d8c15e7d18678dd41771f72ed6693c"
}
}
}
]
}
Fetch list of events filtered by SCAN_STARTED event type
Request
Requires AuthorizationGET /v1/events?event_type[]=554696714&limit=10
Headers
accept: application/json
content-type: application/json
authorization: Basic FILTERED
cURL Edit, then copy and paste on your terminal
curl -X GET \
-H 'accept: application/json' \
-H 'content-type: application/json' \
--compressed -H 'Accept-Encoding: gzip, deflate' \
-u YOUR_API_CLIENT_ID \
'https://api.eu.amp.cisco.com/v1/events?event_type[]=554696714&limit=10'
Response
cURL Edit, then copy and paste on your terminal
curl -X GET \ -H 'accept: application/json' \ -H 'content-type: application/json' \ --compressed -H 'Accept-Encoding: gzip, deflate' \ -u YOUR_API_CLIENT_ID \ 'https://api.eu.amp.cisco.com/v1/events?event_type[]=554696714&limit=10'
Shortened for readability
strict-transport-security: max-age=31536000 content-type: application/json; charset=utf-8 status: 200 OK x-ratelimit-limit: 3000 x-ratelimit-reset: 3543 x-ratelimit-remaining: 2930 x-frame-options: SAMEORIGIN x-ratelimit-resetdate: 2019-11-22T19:40:39Z transfer-encoding: chunked
{
"version": "v1.2.0",
"metadata": {
"links": {
"self": "https://api.eu.amp.cisco.com/v1/events?event_type[]=554696714&limit=10",
"next": "https://api.eu.amp.cisco.com/v1/events?event_type%5B%5D=554696714&limit=10&offset=10"
},
"results": {
"total": 30,
"current_item_count": 10,
"index": 0,
"items_per_page": 10
}
},
"data": [
{
"id": 5832364858376454000,
"timestamp": 1574442424,
"timestamp_nanoseconds": 772000000,
"date": "2019-11-22T17:07:04+00:00",
"event_type": "Scan Started",
"event_type_id": 554696714,
"connector_guid": "17d71471-805b-4183-9121-3924b8982fac",
"group_guids": [
"68665863-74d5-4bc1-ac7f-5477b2b6406e"
],
"computer": {
"connector_guid": "17d71471-805b-4183-9121-3924b8982fac",
"hostname": "Demo_ZAccess",
"external_ip": "5.183.149.147",
"active": true,
"network_addresses": [
{
"ip": "21.199.113.186",
"mac": "b0:5f:19:3a:cd:0d"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/17d71471-805b-4183-9121-3924b8982fac",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/17d71471-805b-4183-9121-3924b8982fac/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
}
},
"scan": {
"description": "C:\\Program Files\\DVD Maker"
}
},
{
"id": 5832364789656977000,
"timestamp": 1574442408,
"timestamp_nanoseconds": 193000000,
"date": "2019-11-22T17:06:48+00:00",
"event_type": "Scan Started",
"event_type_id": 554696714,
"connector_guid": "17d71471-805b-4183-9121-3924b8982fac",
"group_guids": [
"68665863-74d5-4bc1-ac7f-5477b2b6406e"
],
"computer": {
"connector_guid": "17d71471-805b-4183-9121-3924b8982fac",
"hostname": "Demo_ZAccess",
"external_ip": "5.183.149.147",
"active": true,
"network_addresses": [
{
"ip": "21.199.113.186",
"mac": "b0:5f:19:3a:cd:0d"
}
],
"links": {
"computer": "https://api.eu.amp.cisco.com/v1/computers/17d71471-805b-4183-9121-3924b8982fac",
"trajectory": "https://api.eu.amp.cisco.com/v1/computers/17d71471-805b-4183-9121-3924b8982fac/trajectory",
"group": "https://api.eu.amp.cisco.com/v1/groups/68665863-74d5-4bc1-ac7f-5477b2b6406e"
}
},
"scan": {
"description": "C:\\Program Files\\Microsoft Games"
}
}
]
}