{ "openapi": "3.0.0", "info": { "version": "1.0", "title": "Netography APIs", "description": "The Netography API allows you to access the following service functions:\n* Forensics: Search for data (alerts/blocks/flows/dns/traffic).\n* Analytics: Query statistical and analytical data (alerts/blocks/flows/dns).\n* Service Config: Control service configurations (devices/vpcs/labels/tags).\n" }, "servers": [ { "url": "https://api.netography.com", "description": "Netography API" } ], "security": [ { "BearerAuth": [] } ], "tags": [ { "name": "Authentication" }, { "name": "Analytics" }, { "name": "Raw Records - Search" }, { "name": "Raw Records - Fetch" }, { "name": "Block List" }, { "name": "Intelligence" }, { "name": "Labels - IPs" }, { "name": "Labels - Ports" }, { "name": "Configuration" }, { "name": "Detect and Respond - Detection Categories" }, { "name": "Detect and Respond - Traffic Detection Models" }, { "name": "Detect and Respond - Context Creation Models" }, { "name": "Detect and Respond - Response Policies" }, { "name": "Detect and Respond - Threshold Overrides" }, { "name": "Traffic Sources - Devices" }, { "name": "Traffic Sources - DNS Devices" }, { "name": "Traffic Sources - VPCs" }, { "name": "Integrations - Context" }, { "name": "Integrations - Response" }, { "name": "Tags" }, { "name": "Roles" }, { "name": "Users" }, { "name": "API Keys" }, { "name": "Resellers" }, { "name": "Settings - Traffic Classification" }, { "name": "Settings - Security" }, { "name": "Auto Thresholds" }, { "name": "MITRE ATT&CK" } ], "paths": { "/api/v1/auth/token": { "post": { "operationId": "v1_auth_token_post", "security": [], "tags": [ "Authentication" ], "requestBody": { "required": true, "description": "A JSON request body with the key `jwt`.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "jwt": { "type": "string", "description": "A JWT token encoded using your Accounts API Key Shared Secret.", "example": "asd8asd9f87ass...asdf9" } }, "required": [ "jwt" ] } } } }, "summary": "via API Key", "description": "To authenticate to the API, a JWT request token is encoded and sent as the `jwt` param in a `POST` to `/auth/token`. The `access_token` in the response is the JWT bearer token that is included as the `Authorization` value in the `Header` of all subsequent API calls.\n\nIf you do not have the 4 fields below available, see [Create a Netography API Key](ref:create-a-netography-api-key).\n\n## Generating a JWT request token in code\n\n[block:tutorial-tile]\n{\n \"backgroundColor\": \"#018FF4\",\n \"emoji\": \"🦉\",\n \"id\": \"657c52c3a5434c00493811e0\",\n \"link\": \"https://docs.netography.com/v1.0/recipes/create-a-jwt-request-token\",\n \"slug\": \"create-a-jwt-request-token\",\n \"title\": \"Create a JWT request token\"\n}\n[/block]\n\n\n## Generating a JWT request token in browser\n\nTo use API via the API reference pages here, you can create a JWT request token here, and then copy it to the _jwt_ params field below.\n\n[block:embed]\n{\n \"html\": false,\n \"url\": \"https://jsfiddle.net/netography/rex57sb6/12/embedded/result,js,html\",\n \"provider\": \"jsfiddle.net\",\n \"href\": \"https://jsfiddle.net/netography/rex57sb6/12/embedded/result,js,html\",\n \"typeOfEmbed\": \"iframe\",\n \"height\": \"400px\",\n \"width\": \"100%\",\n \"iframe\": true\n}\n[/block]\n\n\n> ↕️ Copy and Paste the JWT request token string\n> \n> To authenticate to the API on this page, you need to copy the token string from the _JWT Request Token_ field directly above, and paste it into the _jwt_ field directly below.\n", "responses": { "200": { "description": "A JSON object which contains the `access_token` to use in all subsequent calls to the API", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "access_token": { "type": "string", "description": "Access Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "expires_in": { "type": "integer", "description": "Seconds until the Access Token expires", "readOnly": true, "example": 86400 }, "refresh_expires_in": { "type": "integer", "description": "Seconds until the Refresh Token expires", "readOnly": true, "example": 86400 }, "refresh_token": { "type": "string", "description": "Refresh Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "token_type": { "type": "string", "description": "Type of JWT token. Will always be \"bearer\"", "readOnly": true, "example": "bearer" }, "id_token": { "type": "string", "description": "ID Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "not-before-policy": { "type": "integer", "description": "Seconds until the Token will be considered valid. Will always be 0 (now).", "readOnly": true, "example": 0 }, "session-state": { "type": "string", "description": "Unique Session ID", "readOnly": true, "example": "9b4b13d7-c7a6-4f68-a419-cf1bf5aef94f" }, "scope": { "type": "string", "description": "Application Scopes", "readOnly": true, "example": "openid email app_metadata user_metadata profile" } } } } } }, "401": { "description": "Missing or invalid credentials", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, "examples": { "InvalidCredentials": { "value": { "status": 401, "name": "UnauthorizedError", "message": "Invalid user credentials" } }, "InvalidSharedSecret": { "value": { "status": 401, "name": "UnauthorizedError", "message": "invalid signature" } }, "InvalidJWT": { "value": { "status": 401, "name": "UnauthorizedError", "message": "Invalid JWT" } }, "IpIsNotAllowed": { "value": { "status": 401, "name": "UnauthorizedError", "message": "Access denied! Your IP is out of the allowed IPs range." } } } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 404 }, "name": { "example": "NotFoundError" }, "message": { "example": "No customer found for " } } } ] } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/auth/bearer/token": { "post": { "operationId": "auth_bearer_token_post", "security": [], "tags": [ "Authentication" ], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "additionalProperties": false, "properties": { "username": { "type": "string", "example": "me@email.com" }, "password": { "type": "string", "format": "password" } }, "required": [ "username", "password" ] } } } }, "summary": "via User Credentials", "description": "Obtain an `access_token` via User Credentials", "responses": { "200": { "description": "A JSON object which contains the `access_token` to use in all subsequent calls to the API", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "access_token": { "type": "string", "description": "Access Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "expires_in": { "type": "integer", "description": "Seconds until the Access Token expires", "readOnly": true, "example": 86400 }, "refresh_expires_in": { "type": "integer", "description": "Seconds until the Refresh Token expires", "readOnly": true, "example": 86400 }, "refresh_token": { "type": "string", "description": "Refresh Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "token_type": { "type": "string", "description": "Type of JWT token. Will always be \"bearer\"", "readOnly": true, "example": "bearer" }, "id_token": { "type": "string", "description": "ID Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "not-before-policy": { "type": "integer", "description": "Seconds until the Token will be considered valid. Will always be 0 (now).", "readOnly": true, "example": 0 }, "session-state": { "type": "string", "description": "Unique Session ID", "readOnly": true, "example": "9b4b13d7-c7a6-4f68-a419-cf1bf5aef94f" }, "scope": { "type": "string", "description": "Application Scopes", "readOnly": true, "example": "openid email app_metadata user_metadata profile" } } } } } }, "401": { "description": "Missing or invalid credentials", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, "examples": { "InvalidCredentials": { "value": { "status": 401, "name": "UnauthorizedError", "message": "Invalid user credentials" } }, "IpIsNotAllowed": { "value": { "status": 401, "name": "UnauthorizedError", "message": "Access denied! Your IP is out of the allowed IPs range." } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/auth/bearer/refresh": { "post": { "operationId": "auth_bearer_refresh_post", "security": [], "tags": [ "Authentication" ], "requestBody": { "required": true, "content": { "application/x-www-form-urlencoded": { "schema": { "type": "object", "additionalProperties": false, "properties": { "refresh_token": { "type": "string", "example": "eyJhbGciOiJIUzI1NiIsInR5c...jUZ8Ud9wGCYilcqEML2fRkWZU" } }, "required": [ "refresh_token" ] } } } }, "summary": "via Refresh Token", "description": "Obtain a new `access_token` via a `refresh_token`", "responses": { "200": { "description": "A JSON object which contains the `access_token` to use in all subsequent calls to the API", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "access_token": { "type": "string", "description": "Access Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "expires_in": { "type": "integer", "description": "Seconds until the Access Token expires", "readOnly": true, "example": 86400 }, "refresh_expires_in": { "type": "integer", "description": "Seconds until the Refresh Token expires", "readOnly": true, "example": 86400 }, "refresh_token": { "type": "string", "description": "Refresh Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "token_type": { "type": "string", "description": "Type of JWT token. Will always be \"bearer\"", "readOnly": true, "example": "bearer" }, "id_token": { "type": "string", "description": "ID Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "not-before-policy": { "type": "integer", "description": "Seconds until the Token will be considered valid. Will always be 0 (now).", "readOnly": true, "example": 0 }, "session-state": { "type": "string", "description": "Unique Session ID", "readOnly": true, "example": "9b4b13d7-c7a6-4f68-a419-cf1bf5aef94f" }, "scope": { "type": "string", "description": "Application Scopes", "readOnly": true, "example": "openid email app_metadata user_metadata profile" } } } } } }, "400": { "description": "Wrong or expired refresh token, or user/api-key removed", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, "examples": { "InvalidRefreshToken": { "value": { "status": 400, "name": "BadRequestError", "message": "Invalid refresh token" } }, "ExpiredRefreshToken": { "value": { "status": 400, "name": "BadRequestError", "message": "Stale token" } }, "MaxRefreshTokenUsage": { "value": { "status": 400, "name": "BadRequestError", "message": "Maximum allowed refresh token reuse exceeded" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/fetch/{context}/{id}": { "get": { "operationId": "v1_fetch_context_id_get", "summary": "Fetch Record", "description": "Fetches a specific context record per the id supplied in the path.\n\nNote: flow records by ID are currently not available.\n", "tags": [ "Raw Records - Fetch" ], "parameters": [ { "name": "context", "in": "path", "description": "Context of the Fields Request", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } }, { "name": "id", "in": "path", "required": true, "description": "The ID of the record to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of records", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "oneOf": [ { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, { "description": "Block Record", "type": "object" }, { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/search/{context}/fields": { "get": { "operationId": "v1_search_context_fields_get", "tags": [ "Raw Records - Search" ], "summary": "Field Values", "description": "Values that can be used for the field parameter in subsequent search API calls", "parameters": [ { "name": "context", "in": "path", "description": "Data category or event type to query (e.g., alerts, audit logs, blocked traffic, network flows, DNS queries)", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/search/{context}": { "post": { "operationId": "v1_search_context_post", "tags": [ "Raw Records - Search" ], "summary": "Search Records", "description": "Retrieves a list of individual events or records for the specified context over a given time range. This call takes advantage of the Netography Query Language via the search parameter.", "parameters": [ { "name": "context", "in": "path", "description": "Data category or event type to query (e.g., alerts, audit logs, blocked traffic, network flows, DNS queries)", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "requestBody": { "description": "Search Body", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "start", "end" ], "description": "Search configuration schema for querying data. This schema defines the parameters used to filter and retrieve records from a dataset.", "additionalProperties": false, "properties": { "start": { "description": "When the search should begin. Timestamp or negative number of seconds to look back.", "type": "integer", "example": -7200 }, "end": { "description": "When the search should end. Timestamp, 0 for now or negative number of seconds to look back.", "type": "integer", "example": 0 }, "size": { "description": "Number of results to return. To avoid timeouts on large datasets, we recommend setting this value.", "type": "integer", "example": 100 }, "from": { "description": "Used in pagination. Combination of from + size", "type": "integer" }, "include": { "description": "Array of fields you want returned as part of the records. Default is ALL fields.", "type": "array", "items": { "type": "string" }, "maxItems": 100 }, "search": { "description": "A NQL search filter for constraining the dataset.", "type": "string", "example": "bits > 1000" } } } } } }, "responses": { "200": { "description": "An object which contains response metadata information and a data array of records", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "oneOf": [ { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, { "description": "Block Record", "type": "object" }, { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/stats/{context}/fields": { "get": { "operationId": "v1_stats_context_fields_get", "tags": [ "Analytics" ], "summary": "Fields", "description": "Values that can be used for the field parameter in subsequent API calls", "parameters": [ { "name": "context", "in": "path", "description": "Context of the Fields Request", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/stats/{context}/aliases": { "get": { "operationId": "v1_stats_context_aliases_get", "tags": [ "Analytics" ], "summary": "Aliases", "description": "Values that can be used for the field parameter in subsequent search API calls. \nAliases are shortcuts for searching multiple fields of a similar nomenclature. \nExamples:\n * ip == 8.8.8.8 will be interpolated to create a search of (dstip = 8.8.8.8 or srcip = 8.8.8.8)\n * ipname == myipname will create a search of (dstipname = myipname or srcipname = myipname)\n * as.number will search the fields dstas.number, dstowneras.number, srcas.number, and srcowneras.number", "parameters": [ { "name": "context", "in": "path", "description": "Context of the Fields Request, e.g. flow", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/stats/{context}/metrics": { "get": { "operationId": "v1_stats_context_metrics_get", "tags": [ "Analytics" ], "summary": "Metrics", "description": "Values that can be used for the metric parameter in subsequent search API calls", "parameters": [ { "name": "context", "in": "path", "description": "Context of the Metrics Request", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/stats/{context}/ts": { "post": { "operationId": "v1_stats_context_ts_post", "tags": [ "Analytics" ], "summary": "Time Series", "description": "Request data as a time series. This is used for charts and graphs.", "parameters": [ { "name": "context", "in": "path", "description": "Data category or event type to query (e.g., alerts, audit logs, blocked traffic, network flows, DNS queries)", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "requestBody": { "description": "JSON structure for a timeseries request", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "start", "end", "series" ], "additionalProperties": false, "properties": { "start": { "type": "integer", "description": "Start time for this time series. Negative for lookback (Eg. -3600 for 1 hour ago) or timestamp in milliseconds.", "example": -3600 }, "end": { "type": "integer", "description": "End time for this time series. Negative for lookback (Eg. -3600 for 1 hour ago), 0 for NOW or timestamp in milliseconds.", "example": 3600 }, "format": { "title": "format", "description": "Series data can be provided in a variety of formats which are native to some charting libraries. e.g. amcharts or highcharts", "type": "string", "default": "highcharts", "enum": [ "amcharts", "d3", "highcharts", "png" ], "example": "highcharts" }, "series": { "type": "array", "maxItems": 25, "description": "List of series to aggregate on. Each series must have a unique name.", "items": { "type": "object", "description": "Configuration for a time series data query that defines how to aggregate and analyze network traffic data over time. Each series specifies the metric to measure, fields to group by, time intervals, and filtering criteria to generate meaningful analytics insights.", "required": [ "name", "metric", "size", "field" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-series-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5 }, "ipagg": { "type": "object", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8 }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset.", "items": { "type": "string" }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "format": "int32", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc" } } } } } } } } }, "responses": { "200": { "description": "An object which contains response metadata information and a data object containing the Time Series array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "date": { "type": "integer", "description": "Unix Timestamp in milliseconds.", "example": 1617902100000 }, "field1": { "description": "data point value", "example": 10669651 } } }, { "type": "array", "description": "d3 series format", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "array", "description": "highcharts series format [ unix timestamp (ms), value ]", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/stats/{context}/agg": { "post": { "operationId": "v1_stats_context_agg_post", "tags": [ "Analytics" ], "summary": "Aggregations", "description": "Get summarized statistics by aggregating data for the specified context over a given time range. Returns computed metrics like counts, sums, averages, etc. rather than individual events.", "parameters": [ { "name": "context", "in": "path", "description": "Data category or event type to query (e.g., alerts, audit logs, blocked traffic, network flows, DNS queries)", "required": true, "schema": { "type": "string", "enum": [ "alert", "audit", "block", "flow", "dns" ] } } ], "requestBody": { "description": "JSON structure for an aggregation request", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "start", "end", "series" ], "additionalProperties": false, "properties": { "start": { "description": "Start time for this time series. Negative for lookback (Eg. -3600 for 1 hour ago) or timestamp in milliseconds.", "type": "integer", "example": -3600 }, "end": { "description": "End time for this time series. Negative for lookback (Eg. -3600 for 1 hour ago), 0 for NOW or timestamp in milliseconds.", "type": "integer", "example": 0 }, "format": { "title": "format", "description": "Series data can be provided in a variety of formats which are native to some charting libraries. e.g. amcharts or highcharts", "type": "string", "default": "highcharts", "enum": [ "amcharts", "d3", "highcharts", "png" ], "example": "highcharts" }, "series": { "type": "array", "maxItems": 25, "description": "List of series to aggregate on. Each series must have a unique name.", "items": { "type": "object", "description": "Configuration for a data aggregation series used in analytics queries. Defines how to group, filter, and aggregate data with various options for fields, metrics, and time intervals.", "required": [ "name", "metric" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-agg-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5, "minimum": 1, "maximum": 2147483647, "format": "int32" }, "ipagg": { "type": "object", "description": "IP aggregation configuration for grouping IP addresses by CIDR blocks.", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8, "minimum": 8, "maximum": 32, "format": "int32" }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`", "example": "srcip" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset. Only one search is allowed for aggregation series.", "items": { "type": "string", "description": "NQL query string for filtering data." }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc", "enum": [ "asc", "desc" ], "example": "desc" } } } } } } } } }, "responses": { "200": { "description": "An object which contains response metadata information and a data object containing the Aggregation array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "interval": { "type": "string", "description": "aggregation time window. e.g. 1s, 1m, 1h, 1d, 1M", "example": "10m" }, "label": { "type": "string", "description": "value of the field in the requested series", "example": "srcip" }, "metric": { "type": "string", "description": "metric describing the data being returned.", "example": "flows" }, "name": { "type": "string", "description": "name of the series, corresponding to the fields provided in the request", "example": "srcip" }, "series": { "type": "string", "description": "name of the series, corresponding to the series name provided in the request", "example": "flow-agg-test" }, "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "category": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "d3 series format", "additionalProperties": false, "properties": { "field1": { "description": "field1 is the value of the field property in the request and it's value is the data point value", "example": 10669651 } } }, { "type": "object", "description": "highcharts series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "y": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/blocks": { "delete": { "operationId": "v1_blocks_delete", "summary": "Clear the Block List", "description": "This method will clear all active blocks from the block list", "tags": [ "Block List" ], "responses": { "204": { "description": "Empty Response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/intel/lookup/asns": { "post": { "operationId": "v1_intel_lookup_asns_post", "summary": "ASN Lookup", "description": "This method takes an array of ASNs and looks up the corresponding ORG.", "requestBody": { "description": "ASN lookup JSON Body.", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "asns" ], "additionalProperties": false, "properties": { "asns": { "description": "Array of AS numbers to lookup org names for", "type": "array", "maxItems": 1000, "items": { "type": "integer" } } }, "example": { "asns": [ 65001, 65002, 65003 ] } } } } }, "tags": [ "Intelligence" ], "responses": { "200": { "description": "ASN Number and Organisation the ASN provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/cve/{cveid}": { "get": { "operationId": "v1_cve_cveid_get", "summary": "CVE Lookup", "description": "Returns Common Vulnerability and Exposure information for the CVE ID provided.\nFor more information on the data returned, see the NIST NVD CVE API response documentation\n", "tags": [ "Intelligence" ], "parameters": [ { "name": "cveid", "in": "path", "required": true, "description": "The unique Common Vulnerabilities and Exposures identifier (the CVE ID)", "schema": { "type": "string" } } ], "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/intel/lookup/ips": { "post": { "operationId": "v1_intel_lookup_ips_post", "summary": "IP Lookup", "description": "This method takes an array of IPs and looks up the corresponding information.", "tags": [ "Intelligence" ], "requestBody": { "description": "IP lookup JSON body.", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "ips" ], "additionalProperties": false, "properties": { "as": { "type": "boolean", "description": "Include Autonomous System information in the response", "example": true }, "bogon": { "type": "boolean", "description": "Include bogon intellegence in the response", "example": true }, "geo": { "type": "boolean", "description": "Include Geolocation Data in the response", "example": true }, "iprep": { "type": "boolean", "description": "Include IP Reputation intellegence in the response", "example": true }, "rdns": { "type": "boolean", "description": "Include RDNS info in the response", "example": true }, "pdns": { "type": "boolean", "description": "Include PDNS info in the response", "example": true }, "ips": { "description": "Array of IP addresses to lookup", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": { "ips": [ "1.0.0.32", "125.64.94.221", "85.105.167.67", "185.176.27.42", "fe80::4f1:cde3:2b85:7c7d", "162.243.150.19" ] } } } } } } }, "responses": { "200": { "description": "Ip Intelligence information for the ip addresses provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "bogon": { "description": "Is a bogon or not", "type": "boolean", "example": false }, "ip": { "description": "IP Address", "type": "string", "example": "1.0.0.32" }, "firstseen": { "description": "Timestamp of first time this ip address was seen.", "type": "integer", "example": 1617980476 }, "lastseen": { "description": "Timestamp of last time this ip address was seen.", "type": "integer", "example": 1617991633 }, "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "iprep": { "description": "Object with ip reputation information", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "categories": { "type": "array", "description": "Array of geo reputation categories this ip address has been flagged in.", "maxItems": 1000, "items": { "type": "string", "example": "ddos" } } } }, "geo": { "description": "Object with geographic location information", "type": "object" }, "as": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "rdns": { "description": "Reverse DNS", "type": "string", "example": false }, "pdns": { "description": "Protective DNS", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "records": { "type": "array", "description": "Array of PDNS records", "maxItems": 1000, "items": { "type": "string" } } } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips": { "get": { "operationId": "v1_labels_ips_get", "summary": "List IP Labels", "description": "Returns an array of ip labels.", "tags": [ "Labels - IPs" ], "responses": { "200": { "description": "List of IP Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_labels_ips_post", "summary": "Create IP Label", "description": "Creates a IP label from the data that's been supplied", "requestBody": { "description": "IP label to be added", "required": true, "content": { "application/json": { "schema": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } }, "tags": [ "Labels - IPs" ], "responses": { "201": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_labels_ips_put", "summary": "Update IP Label", "description": "Update an IP Label given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "IP Label to be updated", "required": true, "content": { "application/json": { "schema": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } }, "tags": [ "Labels - IPs" ], "responses": { "200": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips/all/{context}": { "get": { "operationId": "v1_labels_ips_all_context_get", "summary": "List IP Labels by context", "description": "Fetches all labels by a specific context for all IPs.", "tags": [ "Labels - IPs" ], "parameters": [ { "name": "context", "in": "path", "required": true, "description": "The context of the IP labels to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips/{ip}": { "get": { "operationId": "v1_labels_ips_ip_get", "summary": "List IP Labels by ip", "description": "Fetches a all IP labels for the IP address supplied in the path.", "tags": [ "Labels - IPs" ], "parameters": [ { "name": "ip", "in": "path", "required": true, "description": "The IP Address of the IP labels to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips/{ip}/{context}": { "get": { "operationId": "v1_labels_ips_ip_context_get", "summary": "List IP Labels by ip:context", "description": "Fetches a specific IP label from the IP supplied in the path.", "tags": [ "Labels - IPs" ], "parameters": [ { "name": "ip", "in": "path", "required": true, "description": "The IP Address of the IP labels to be returned.", "schema": { "type": "string" } }, { "name": "context", "in": "path", "required": true, "description": "The context of the IP labels.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_labels_ips_ip_context_delete", "summary": "Delete IP labels by ip:context", "description": "Removes all the labels for the provided context.", "tags": [ "Labels - IPs" ], "parameters": [ { "name": "ip", "in": "path", "required": true, "description": "The IP of the IP label to be deleted.", "schema": { "type": "string" } }, { "name": "context", "in": "path", "required": true, "description": "The context of the IP label to be deleted.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips/bulk": { "put": { "operationId": "v1_labels_ips_bulk_put", "summary": "Bulk Create/Update IP Labels", "description": "Bulk create/update IP labels. \nNew labels will be created, and existing labels will be replaced. \nLimited to 10,000 labels per request. \n**Note: the API path has changed from previous versions**\n", "requestBody": { "description": "Array of IP labels to be uploaded", "required": true, "content": { "application/json": { "schema": { "type": "array", "maxItems": 10000, "items": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } }, "tags": [ "Labels - IPs" ], "responses": { "201": { "description": "Result of IP Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_labels_ips_bulk_delete", "summary": "Bulk Delete IP Labels", "description": "Bulk delete IP labels from the data that's been supplied.", "requestBody": { "description": "IP labels to be deleted", "required": true, "content": { "application/json": { "schema": { "type": "array", "maxItems": 10000, "items": { "description": "Delete IP Labels via ip or context or both. One of ip or context is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address.", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. Default context is 'name'. Optional if ip is provided.", "type": "string", "example": "name" } } } } } } }, "tags": [ "Labels - IPs" ], "responses": { "200": { "description": "Result of IP Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ips/upload": { "put": { "operationId": "v1_labels_ips_upload_put", "summary": "Upload IP Labels", "description": "Upload IP labels via a CSV file. New labels will be created, and existing labels will be replaced. Limited to 10,000 labels per request.
The CSV must be a text file and should NOT have any headers. Multiple labels can be assigned per context by having additional columns.

Example CSV:
```IP1, Context1, Label1```
```IP1, Context2, Label1, Label2```
```IP2, Context1, Label3```
```IP2, Context4, Label4, Label5, Label6```
", "requestBody": { "required": true, "description": "form data body with a `file` key", "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "text", "description": "The CSV file to upload" } } } } } }, "tags": [ "Labels - IPs" ], "responses": { "201": { "description": "Result of IP Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports": { "get": { "operationId": "v1_labels_ports_get", "summary": "List Port Labels", "description": "Returns an array of port labels.", "tags": [ "Labels - Ports" ], "responses": { "200": { "description": "List of Port Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_labels_ports_post", "summary": "Create Port Label", "description": "Creates a port label from the data that's been supplied", "requestBody": { "description": "Port label to be added", "required": true, "content": { "application/json": { "schema": { "description": "Port Label Create Config", "type": "object", "required": [ "protocol", "port", "labels" ], "additionalProperties": false, "properties": { "protocol": { "description": "Protocol.", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } }, "tags": [ "Labels - Ports" ], "responses": { "201": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_labels_ports_put", "summary": "Update Port Label", "description": "Update a Port Label given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Port Label to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Port Label Create Config", "type": "object", "required": [ "protocol", "port", "labels" ], "additionalProperties": false, "properties": { "protocol": { "description": "Protocol.", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } }, "tags": [ "Labels - Ports" ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/protocols": { "get": { "operationId": "v1_labels_ports_protocols_get", "summary": "List Configured Protocols", "description": "Returns an array of protocols.", "tags": [ "Labels - Ports" ], "responses": { "200": { "description": "List of Port Labels Protocols Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Protocol name", "example": "tcp" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/all/{protocol}": { "get": { "operationId": "v1_labels_ports_all_protocol_get", "summary": "List Port Labels by protocol", "description": "Fetches all labels by a specific protocol for all Ports.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the Port labels to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/{port}": { "get": { "operationId": "v1_labels_ports_port_get", "summary": "List Port Labels by port", "description": "Fetches a all Port labels for the port supplied in the path.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The Port number of the Port labels to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/{port}/{protocol}": { "get": { "operationId": "v1_labels_port_protocol_get", "summary": "Fetch Port Label", "description": "Fetches a specific port label from the protocol and port supplied in the path.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The port of the port label to be returned.", "schema": { "type": "string" } }, { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the port label to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_labels_port_protocol_delete", "summary": "Delete Port Label by port:protocol", "description": "Delete Port Label", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The port of the port label to be deleted.", "schema": { "type": "string" } }, { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the port label to be deleted.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/{port}/{protocol}/show": { "put": { "operationId": "v1_labels_ports_port_protocol_show", "summary": "Expose Port Label", "description": "Expose (un-hide) a hidden system port label.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The port of the port label to be exposed. Labels in this protocol will now appear for this Port in the UI.", "schema": { "type": "string" } }, { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the port label to be shown.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/{port}/{protocol}/hide": { "put": { "operationId": "v1_labels_ports_protocol_hide_put", "summary": "Hide Port Label", "description": "Hide system port label.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The port of the port label to be hidden.", "schema": { "type": "string" } }, { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the port label to be hidden.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/{port}/{protocol}/reset": { "put": { "operationId": "v1_labels_ports_port_protocol_reset_put", "summary": "Reset Port Label", "description": "Reset system port label to default state.", "tags": [ "Labels - Ports" ], "parameters": [ { "name": "port", "in": "path", "required": true, "description": "The port of the port label to be reset.", "schema": { "type": "string" } }, { "name": "protocol", "in": "path", "required": true, "description": "The protocol of the port label to be reset.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/bulk": { "put": { "operationId": "v1_labels_ports_bulk_put", "summary": "Bulk Upload Port Labels", "description": "Bulk upload port labels. New labels will be created, and existing labels will be replaced. Limited to 10,000 labels per request.", "requestBody": { "description": "Array of Port labels to be uploaded", "required": true, "content": { "application/json": { "schema": { "type": "array", "maxItems": 10000, "items": { "description": "Port Label Create Config", "type": "object", "required": [ "protocol", "port", "labels" ], "additionalProperties": false, "properties": { "protocol": { "description": "Protocol.", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } }, "tags": [ "Labels - Ports" ], "responses": { "201": { "description": "Result of Port Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_labels_ports_bulk_delete", "summary": "Bulk Delete Port Labels", "description": "Bulk delete port labels from the data that's been supplied", "requestBody": { "description": "Port labels to be deleted", "required": true, "content": { "application/json": { "schema": { "type": "array", "maxItems": 10000, "items": { "description": "Delete Port Labels via port or protocol or both. One of port or protocol is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "port": { "description": "Port. Optional if protocol is provided.", "type": "number", "example": 1 }, "protocol": { "description": "Protocol. Optional is port is provided.", "type": "string", "example": "udp" } } } } } } }, "tags": [ "Labels - Ports" ], "responses": { "201": { "description": "Result of Port Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/labels/ports/upload": { "put": { "operationId": "v1_labels_ports_upload_put", "summary": "Upload Port Labels", "description": "Upload Port labels via a CSV file. New labels will be created, and existing labels will be replaced. Limited to 10,000 labels per request.
The CSV must be a text file and should NOT have any headers. Multiple labels can be assigned per protocol by having additional columns.

Example CSV:
```Port1, Protocol1, Label1```
```Port1, Protocol2, Label1, Label2```
```Port2, Protocol1, Label3```
```Port2, Protocol4, Label4, Label5, Label6```
", "requestBody": { "required": true, "description": "form data body with a `file` key", "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "text", "description": "The CSV file to upload" } } } } } }, "tags": [ "Labels - Ports" ], "responses": { "201": { "description": "Result of Port Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/aws/role": { "get": { "operationId": "v1_integrations_aws_role_get", "summary": "Netography AWS Custom Trust Policy", "description": "Information relating to configuring AWS Role based authentication. \nProvides Netography's Account Id, sts:ExternalId and an example usage in a custom trust policy.\nRole based AWS authentication can be used in Flow Sources and Context Integrations.\n", "tags": [ "Configuration" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "netography_aws_acountid": { "type": "string", "readOnly": true, "description": "Netography's AWS Account ID" }, "externalid": { "type": "string", "description": "Netography-issued External ID (sts:ExternalId) for AWS role creation" }, "aws_trust_policy_example": { "type": "string", "description": "Example AWS trust policy" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/devices": { "get": { "operationId": "v1_devices_get", "summary": "List Devices", "description": "Returns an array of devices.", "tags": [ "Traffic Sources - Devices" ], "responses": { "200": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/device": { "post": { "operationId": "v1_device_post", "summary": "Create Device", "description": "Creates a device from the data that's been supplied. Do not provide an id. IDs are auto generated", "requestBody": { "description": "Device to be added", "required": true, "content": { "application/json": { "schema": { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } } } }, "tags": [ "Traffic Sources - Devices" ], "responses": { "201": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/device/{id}": { "get": { "operationId": "v1_device_id_get", "summary": "Fetch Device", "description": "Fetches a specific device from the ID supplied in the path.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the device to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_devoce_id_put", "summary": "Update Device", "description": "Update a device given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Device to be updated", "required": true, "content": { "application/json": { "schema": { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } } } }, "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the device to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_device_id_delete", "summary": "Delete Device", "description": "Deletes a device", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the device to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/devices/status": { "get": { "operationId": "v1_devices_status_get", "summary": "List Device Statuses", "description": "Returns an array of device status objects.", "tags": [ "Traffic Sources - Devices" ], "responses": { "200": { "description": "List of Device States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 114300552 }, "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.site.company.com" }, "flow": { "required": [ "lastseen", "active" ], "additionalProperties": false, "properties": { "lastseen": { "description": "Unix timestamp of last seen flow.", "type": "number", "example": 1558367737 }, "active": { "description": "Actively receiving flow.", "type": "boolean", "example": true } }, "type": "object" }, "bgp": { "type": "object", "additionalProperties": false, "properties": { "active": { "description": "BGP is active", "type": "boolean", "example": false } } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/device/status/{id}": { "get": { "operationId": "v1_device_status_id_get", "summary": "Fetch Device Status", "description": "Fetches a specific device from the ID supplied in the path.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the device to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Device States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 114300552 }, "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.site.company.com" }, "flow": { "required": [ "lastseen", "active" ], "additionalProperties": false, "properties": { "lastseen": { "description": "Unix timestamp of last seen flow.", "type": "number", "example": 1558367737 }, "active": { "description": "Actively receiving flow.", "type": "boolean", "example": true } }, "type": "object" }, "bgp": { "type": "object", "additionalProperties": false, "properties": { "active": { "description": "BGP is active", "type": "boolean", "example": false } } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc": { "get": { "operationId": "v1_vpc_get", "summary": "List All VPCs", "description": "Return a list of all Cloud Sources. Supports filtering by flowtype, flowresource, traffictype, and logtype (all together or separate).\n", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "name": "flowtype", "in": "query", "description": "Filter by flow type (e.g., aws, azure, gcp, etc.)", "required": false, "schema": { "type": "string" } }, { "name": "flowresource", "in": "query", "description": "Filter by flow resource (e.g., s3, kinesis, etc.)", "required": false, "schema": { "type": "string" } }, { "name": "traffictype", "in": "query", "description": "Filter by traffic type (e.g., dns, flow)", "required": false, "schema": { "type": "string" } }, { "name": "logtype", "in": "query", "description": "Filter by log type (e.g., gcp-dns-query-log, etc.)", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_vpc_post", "summary": "Create VPC", "description": "Create a VPC from the supplied object. Do NOT submit an ID. IDs are auto generated and immutable.", "requestBody": { "description": "VPC to be added", "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Azure VNet Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networkwatcher", "resourcegroup", "subscriptionid", "flowlog" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure-vnet" ], "example": "azure-vnet" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of this flow source in Netography Fusion. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "Enable or disable polling the cloud provider for samples", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account Name where flow logs are stored", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n", "example": "insights-logs-flowlogflowevent" }, "networkwatcher": { "type": "string", "description": "Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n", "example": "NetworkWatcher_eastus" }, "resourcegroup": { "type": "string", "description": "Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n", "example": "NETWORKWATCHERRG" }, "flowlog": { "type": "string", "description": "Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n", "example": "flowlog-eastus-prod" }, "subscriptionid": { "type": "string", "description": "Network Watcher Subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } }, "tags": [ "Traffic Sources - VPCs" ], "responses": { "201": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/{id}": { "get": { "operationId": "v1_vpc_id_get", "summary": "Get VPC", "description": "Fetches a specific VPC from the ID supplied in the path.", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true, "description": "Numeric ID of the VPC to get" } ], "responses": { "200": { "description": "Object of a VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_vpc_id_put", "summary": "Update VPC", "description": "Update a VPC given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "VPC to be updated", "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Azure VNet Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networkwatcher", "resourcegroup", "subscriptionid", "flowlog" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure-vnet" ], "example": "azure-vnet" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of this flow source in Netography Fusion. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "Enable or disable polling the cloud provider for samples", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account Name where flow logs are stored", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n", "example": "insights-logs-flowlogflowevent" }, "networkwatcher": { "type": "string", "description": "Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n", "example": "NetworkWatcher_eastus" }, "resourcegroup": { "type": "string", "description": "Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n", "example": "NETWORKWATCHERRG" }, "flowlog": { "type": "string", "description": "Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n", "example": "flowlog-eastus-prod" }, "subscriptionid": { "type": "string", "description": "Network Watcher Subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } }, "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the VPC to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_vpc_id_delete", "summary": "Delete VPC", "description": "Deletes the VPC and shuts down the kinesis feed.", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the VPC to be retrieved", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/{id}/enable": { "put": { "operationId": "v1_vpc_id_enable_put", "summary": "Enable VPC", "description": "Enables flow polling for the indicated VPC", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true, "description": "Numeric ID of the VPC to get" } ], "responses": { "200": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/{id}/disable": { "put": { "operationId": "v1_vpc_id_disable_put", "summary": "Disable VPC", "description": "Disables flow polling for the indicated VPC", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "integer" }, "required": true, "description": "Numeric ID of the VPC to get" } ], "responses": { "200": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/status": { "get": { "operationId": "v1_vpc_status_get", "summary": "List VPC Statuses", "description": "Returns an array of vpc status objects.", "tags": [ "Traffic Sources - VPCs" ], "responses": { "200": { "description": "List of VPC States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the vpc. This is immutable.", "example": 892079680 }, "name": { "description": "The name of the VPC.", "type": "string", "example": "prod-vpc-east" }, "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure", "aws" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events", "type": "string", "enum": [ "s3", "kinesis", "blobstorage", "pubsub", "objectstorage" ], "example": "blobstorage" }, "enabled": { "description": "If vpc flow collection is activated", "type": "boolean", "example": true }, "time": { "description": "Time stamp of last attempted poll", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "success": { "description": "true if last poll was successful", "type": "boolean", "example": true, "readOnly": true }, "attempt": { "description": "Count of job restarts since last reset.", "type": "integer", "example": 0, "readOnly": true }, "created": { "description": "The time at which config was created.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "lastupdated": { "description": "The last time config was changed.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "error": { "description": "Array of error messages (if known)", "type": "array", "items": { "type": "string" }, "example": [ "Invalid credentials" ], "readOnly": true }, "progress": { "type": "array", "description": "Array of output from checkpoints or steps to complete the capture of flow.", "items": { "type": "object", "properties": { "step": { "type": "string", "readOnly": true, "description": "A check point step.", "example": "COS Session Created" }, "description": { "type": "string", "readOnly": true, "description": "Details about this step.", "example": "Create client session connection to cloud object storage." }, "error": { "type": "string", "readOnly": true, "description": "Error encountered during this step." }, "status": { "type": "string", "readOnly": true, "description": "Status of this step.", "example": "pass" } } }, "readOnly": true } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/status/{id}": { "get": { "operationId": "v1_vpc_status_id_get", "summary": "Fetch VPC Status", "description": "Fetches a specific VPC from the ID supplied in the path.", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the vpc to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of VPC States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the vpc. This is immutable.", "example": 892079680 }, "name": { "description": "The name of the VPC.", "type": "string", "example": "prod-vpc-east" }, "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure", "aws" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events", "type": "string", "enum": [ "s3", "kinesis", "blobstorage", "pubsub", "objectstorage" ], "example": "blobstorage" }, "enabled": { "description": "If vpc flow collection is activated", "type": "boolean", "example": true }, "time": { "description": "Time stamp of last attempted poll", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "success": { "description": "true if last poll was successful", "type": "boolean", "example": true, "readOnly": true }, "attempt": { "description": "Count of job restarts since last reset.", "type": "integer", "example": 0, "readOnly": true }, "created": { "description": "The time at which config was created.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "lastupdated": { "description": "The last time config was changed.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "error": { "description": "Array of error messages (if known)", "type": "array", "items": { "type": "string" }, "example": [ "Invalid credentials" ], "readOnly": true }, "progress": { "type": "array", "description": "Array of output from checkpoints or steps to complete the capture of flow.", "items": { "type": "object", "properties": { "step": { "type": "string", "readOnly": true, "description": "A check point step.", "example": "COS Session Created" }, "description": { "type": "string", "readOnly": true, "description": "Details about this step.", "example": "Create client session connection to cloud object storage." }, "error": { "type": "string", "readOnly": true, "description": "Error encountered during this step." }, "status": { "type": "string", "readOnly": true, "description": "Status of this step.", "example": "pass" } } }, "readOnly": true } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/regions": { "get": { "operationId": "v1_vpc_regions_get", "summary": "List VPC Regions", "description": "Return all regions for each provider.", "tags": [ "Traffic Sources - VPCs" ], "responses": { "200": { "description": "An object which contains response metadata information and a data object containing the region array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of region.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "id of the region", "readOnly": true, "example": "aws_ap-east-1" }, "description": { "type": "string", "description": "description of the", "readOnly": true, "example": "Asia Pacific (Hong Kong)" }, "label": { "type": "string", "readOnly": true, "description": "label of the region.", "example": "ap-east-1" }, "provider": { "type": "string", "readOnly": true, "description": "provider of the region", "example": "aws" }, "region": { "type": "string", "readOnly": true, "description": "region the service is located in.", "example": "us-east-1" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/vpc/regions/{flowtype}": { "get": { "operationId": "v1_vpc_regions_flowtype_get", "summary": "Get VPC regions by flowtype", "description": "Returns VPC regions for a specific provider/flowtype.", "tags": [ "Traffic Sources - VPCs" ], "parameters": [ { "in": "path", "name": "flowtype", "schema": { "type": "string", "enum": [ "aws", "azure", "gcp", "ibm", "oracle" ] }, "required": true, "description": "Flow Type to filter the VPC regions list by" } ], "responses": { "200": { "description": "An object which contains response metadata information and a data object containing the region array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of region.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "id of the region", "readOnly": true, "example": "aws_ap-east-1" }, "description": { "type": "string", "description": "description of the", "readOnly": true, "example": "Asia Pacific (Hong Kong)" }, "label": { "type": "string", "readOnly": true, "description": "label of the region.", "example": "ap-east-1" }, "provider": { "type": "string", "readOnly": true, "description": "provider of the region", "example": "aws" }, "region": { "type": "string", "readOnly": true, "description": "region the service is located in.", "example": "us-east-1" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/context": { "get": { "operationId": "v1_integrations_context_get", "summary": "List Context Integrations", "description": "Returns an array of context integrations.", "tags": [ "Integrations - Context" ], "responses": { "200": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_integrations_context_post", "summary": "Create Context Integration", "description": "Creates a context integration from the data that's been supplied. Do not provide an id. IDs are auto generated", "requestBody": { "description": "Integration to be added. Parameters are dependant on which context 'type' is provided.", "required": true, "content": { "application/json": { "schema": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } }, "tags": [ "Integrations - Context" ], "responses": { "201": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/context/{id}": { "get": { "operationId": "v1_integrations_context_id_get", "summary": "Fetch Context Integration", "description": "Fetches a specific context integration from the ID supplied in the path.", "tags": [ "Integrations - Context" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context integration to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_integrations_context_id_put", "summary": "Update Context Integration", "description": "Update a context integration given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Context Integration to be updated", "required": true, "content": { "application/json": { "schema": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } }, "tags": [ "Integrations - Context" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context integration to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_integrations_context_id_delete", "summary": "Delete Context Integration", "description": "Deletes a context integration", "tags": [ "Integrations - Context" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context integration to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/context/{id}/run": { "get": { "operationId": "v1_integrations_context_id_run_get", "summary": "Dry Run/Test a Context Integration", "description": "Runs the specified context integration. Retuns a list of ip labels that would be imported when the context integration is run.", "tags": [ "Integrations - Context" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context integration to be test run.", "schema": { "type": "integer" } } ], "responses": { "200": { "description": "List of IP Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_integrations_context_id_run_put", "summary": "Run a Context Integration", "description": "Runs the specified context integration. Returns a list of ip labels that were imported.", "tags": [ "Integrations - Context" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context integration to be test run.", "schema": { "type": "integer" } } ], "responses": { "200": { "description": "List of IP Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/context/{id}/regenkeys": { "put": { "operationId": "v1_integrations_context_id_regenkeys_put", "summary": "Regenerate private/public keys.", "description": "Only applicable to Oracle Cloud.", "tags": [ "Integrations - Context" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true, "description": "String ID of the role to get" } ], "responses": { "200": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/response": { "get": { "operationId": "v1_integrations_response_get", "summary": "List Response Integrations", "description": "Returns an array of response integrations.", "tags": [ "Integrations - Response" ], "responses": { "200": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_integrations_response_post", "summary": "Create Response Integration", "description": "Creates a response integration from the data that's been supplied. Do not provide an id. IDs are auto generated", "requestBody": { "description": "Response Integration to be added", "required": true, "content": { "application/json": { "schema": { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } } } }, "tags": [ "Integrations - Response" ], "responses": { "201": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/response/test": { "post": { "operationId": "v1_integrations_test_post", "summary": "Test a Response Integration Configuration", "description": "Tests the supplied Response Integration configuration.", "tags": [ "Integrations - Response" ], "requestBody": { "description": "Response Integration to be added", "required": true, "content": { "application/json": { "schema": { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } } } }, "responses": { "201": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/integrations/response/{id}": { "get": { "operationId": "v1_integrations_response_id_get", "summary": "Fetch Response Integration", "description": "Fetches a specific response integration from the ID supplied in the path.", "tags": [ "Integrations - Response" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response integration to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_integrations_response_id_put", "summary": "Update Response Integration", "description": "Update a response integration given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Response Integration to be updated", "required": true, "content": { "application/json": { "schema": { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } } } }, "tags": [ "Integrations - Response" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response integration to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_integrations_response_id_delete", "summary": "Delete Response Integration", "description": "Deletes a response integration", "tags": [ "Integrations - Response" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response integration to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/tags": { "get": { "operationId": "v1_tags_get", "summary": "List Tags", "description": "Return a list of all Tags.", "tags": [ "Tags" ], "parameters": [ { "name": "terse", "in": "query", "description": "boolean as integer. default 1 (true). 0 for false. true will return a simple array of tags, e.g. [ 'tag1', 'tag2', 'tag3', ... ]", "required": false, "schema": { "type": "integer" }, "example": 0 } ], "responses": { "200": { "description": "An array of Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "required": [ "entitytype", "entityname", "entityid", "tag" ], "additionalProperties": false, "properties": { "entitytype": { "type": "string", "description": "entity this tag is associated with", "enum": [ "device", "flow", "vpc" ], "example": "flow" }, "entityname": { "type": "string", "description": "name of the entity", "example": "Flow Rule 1" }, "entityid": { "type": "string", "readOnly": true, "description": "id of the entity", "example": 325067628 }, "tag": { "type": "string", "description": "value of the tag", "example": "mytag" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/tags/{entitytype}": { "get": { "operationId": "v1_tags_entitytype_get", "summary": "List Tags by Entity Type", "description": "Return a list of all Tags.", "tags": [ "Tags" ], "parameters": [ { "name": "entitytype", "in": "path", "description": "Entity Type of the Tags, e.g. device, flow, vpc", "required": true, "schema": { "type": "string", "enum": [ "device", "flow", "vpc" ] } }, { "name": "terse", "in": "query", "description": "boolean as integer. default 1 (true). 0 for false. true will return a simple array of tags, e.g. [ 'tag1', 'tag2', 'tag3', ... ]", "required": false, "schema": { "type": "integer" }, "example": 0 } ], "responses": { "200": { "description": "An array of Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "required": [ "entitytype", "entityname", "entityid", "tag" ], "additionalProperties": false, "properties": { "entitytype": { "type": "string", "description": "entity this tag is associated with", "enum": [ "device", "flow", "vpc" ], "example": "flow" }, "entityname": { "type": "string", "description": "name of the entity", "example": "Flow Rule 1" }, "entityid": { "type": "string", "readOnly": true, "description": "id of the entity", "example": 325067628 }, "tag": { "type": "string", "description": "value of the tag", "example": "mytag" } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/tags/ip": { "get": { "operationId": "v1_tags_ip_get", "summary": "Get Tag Values for IP", "description": "Returns all tag values associated with a specific IP address within the specified timeframe.\n\nThis endpoint allows you to retrieve all tags that have been applied to flows associated with the given IP address during the specified time period.\n", "tags": [ "Tags" ], "parameters": [ { "name": "ip", "in": "query", "description": "The IP address to retrieve tag values for", "required": true, "schema": { "type": "string" }, "example": "20.60.146.129" }, { "name": "start", "in": "query", "description": "Start time for the query. Negative values represent lookback time in seconds from now \n(e.g., -86400 for 24 hours ago), or positive values represent Unix timestamp in seconds.\n", "required": true, "schema": { "type": "integer" }, "example": -86400 }, { "name": "end", "in": "query", "description": "End time for the query. Negative values represent lookback time in seconds from now \n(e.g., -3600 for 1 hour ago), 0 for current time, or positive values represent Unix timestamp in seconds.\n", "required": true, "schema": { "type": "integer" }, "example": 0 } ], "responses": { "200": { "description": "Tag values for an IP address within a timeframe", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "type": "string", "description": "tag value", "example": "web-traffic" } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/tag/flow": { "post": { "operationId": "v1_tag_flow_post", "summary": "Create Flow Tag", "description": "Create a Tag given the provided object.", "requestBody": { "description": "Tag to be added", "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } ] } } } }, "tags": [ "Tags" ], "responses": { "201": { "description": "An array of Flow Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/tag/flow/{id}": { "get": { "operationId": "v1_tag_flow_id_get", "summary": "Get Flow Tag", "description": "Fetches a specific Flow Tag from the ID supplied in the path.", "tags": [ "Tags" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the Flow Tag to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "An array of Flow Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_tag_flow_id_put", "summary": "Update Flow Tag", "description": "Update a Flow Tag given the provided object. This does not do a diff. You must send the complete object and have at least 1 match criteria set.", "requestBody": { "description": "Flow Tag Rule to be updated", "required": true, "content": { "application/json": { "schema": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } }, "tags": [ "Tags" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the Flow Tag Rule to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "An array of Flow Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_tag_flow_id_delete", "summary": "Delete Flow Tag", "description": "Deletes the Flow Tag.", "tags": [ "Tags" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the Flow Tag Rule to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "Empty response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/roles/permissions": { "get": { "operationId": "v1_roles_permissions_get", "summary": "List Role Permissions", "description": "Return a list of permissions available for Roles.", "tags": [ "Roles" ], "responses": { "200": { "description": "Object of available role permissions", "content": { "application/json": { "schema": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/roles": { "get": { "operationId": "v1_roles_get", "summary": "List Roles", "description": "Return a list of all Roles.", "tags": [ "Roles" ], "responses": { "200": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_roles_post", "summary": "Create Role", "description": "Create a Role from the supplied object. Do NOT submit an ID. IDs are auto generated and immutable.", "requestBody": { "description": "Role to be added", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the role.", "type": "string", "example": "my_role" }, "description": { "description": "A user friendly description of the role.", "type": "string", "example": "Role for Testing" }, "canMasquerade": { "description": "(resellers only) Whether or not the role can masquerade into sub accounts.", "type": "boolean", "example": true, "default": false }, "canSendFlow": { "description": "Whether or not the role can send NetoFlow.", "type": "boolean", "example": true, "default": false }, "permissions": { "type": "array", "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] }, "example": [ { "resource": "account", "fetch": true, "create": true, "update": true, "delete": true }, { "resource": "customer", "fetch": true, "create": false, "update": false, "delete": false } ] } } } ] } } } }, "tags": [ "Roles" ], "responses": { "201": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/roles/{id}": { "get": { "operationId": "v1_roles_id_get", "summary": "Get Role", "description": "Fetches a specific Role from the ID supplied in the path.", "tags": [ "Roles" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true, "description": "String ID of the role to get" } ], "responses": { "200": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_roles_id_put", "summary": "Update Role", "description": "Update a Role given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Role to be updated", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the role.", "type": "string", "example": "my_role" }, "description": { "description": "A user friendly description of the role.", "type": "string", "example": "Role for Testing" }, "canMasquerade": { "description": "(resellers only) Whether or not the role can masquerade into sub accounts.", "type": "boolean", "example": true, "default": false }, "canSendFlow": { "description": "Whether or not the role can send NetoFlow.", "type": "boolean", "example": true, "default": false }, "permissions": { "type": "array", "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] }, "example": [ { "resource": "account", "fetch": true, "create": true, "update": true, "delete": true }, { "resource": "customer", "fetch": true, "create": false, "update": false, "delete": false } ] } } } ] } } } }, "tags": [ "Roles" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the Role to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_roles_id_delete", "summary": "Delete Role", "description": "Deletes the Role. API will return a 409 Conflict if the role is in use.", "tags": [ "Roles" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the Role to be retrieved", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/users": { "get": { "operationId": "v1_users_get", "summary": "List Users", "description": "Return a list of all Users.", "tags": [ "Users" ], "responses": { "200": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/user": { "post": { "operationId": "v1_user_get", "summary": "Create User", "description": "Create a User from the supplied object. Do NOT submit an ID. IDs are auto generated and immutable.
Note: This API is rate limited to 50 requests per 300 seconds.", "requestBody": { "description": "User to be added", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "required": [ "given_name", "family_name", "email", "roles" ], "additionalProperties": false, "properties": { "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "admin" ] } } } ] } } } }, "tags": [ "Users" ], "responses": { "201": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/user/{id}": { "get": { "operationId": "v1_user_id_get", "summary": "Get User", "description": "Fetches a specific User from the ID supplied in the path.", "tags": [ "Users" ], "parameters": [ { "in": "path", "name": "id", "schema": { "type": "string" }, "required": true, "description": "String ID of the user to get" } ], "responses": { "200": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_user_id_put", "summary": "Update User", "description": "Update a User given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "User to be updated", "required": true, "content": { "application/json": { "schema": { "required": [ "given_name", "family_name", "email", "roles" ], "additionalProperties": false, "properties": { "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "admin" ] } } } } } }, "tags": [ "Users" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the User to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_user_id_delete", "summary": "Delete User", "description": "Deletes the User.", "tags": [ "Users" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the User to be retrieved", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/api-keys": { "get": { "operationId": "v1_api_keys_get", "summary": "List API Keys", "description": "Return a list of all API Keys.", "tags": [ "API Keys" ], "responses": { "200": { "description": "List of Requested API Keys", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_api_keys_post", "summary": "Create API Key", "description": "Create an API Key from the supplied object.", "requestBody": { "description": "API Key to be added", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "description": "API Key Create Config", "type": "object", "required": [ "appname", "roles" ], "properties": { "appname": { "description": "API Key Name", "type": "string", "example": "my_application" }, "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } } ] } } } }, "tags": [ "API Keys" ], "responses": { "201": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "appkey": { "type": "string", "readOnly": true, "description": "The API Key", "example": "fMBQnzyGRnHuTEjhOclqZwHTPh7dBP1MkZtV" } } }, { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/api-keys/{appname}": { "get": { "operationId": "v1_api_keys_appname_get", "summary": "Get API Key", "description": "Fetches a specific API Key from the appname supplied in the path.", "tags": [ "API Keys" ], "parameters": [ { "in": "path", "name": "appname", "schema": { "type": "string" }, "required": true, "description": "String appname of the API Key to get" } ], "responses": { "200": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_api_keys_appname_put", "summary": "Update API Key", "description": "Update a API Key given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "API Key to be updated", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "description": "API Key Update Config", "type": "object", "properties": { "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } } ] } } } }, "tags": [ "API Keys" ], "parameters": [ { "in": "path", "name": "appname", "schema": { "type": "string" }, "required": true, "description": "String appname of the API Key to get" } ], "responses": { "200": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_api_keys_appname_delete", "summary": "Delete API Key", "description": "Deletes the API Key", "tags": [ "API Keys" ], "parameters": [ { "in": "path", "name": "appname", "schema": { "type": "string" }, "required": true, "description": "String appname of the API Key to get" } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/api-keys/{appname}/regen": { "put": { "operationId": "v1_api_keys_appname_regen_put", "summary": "Update API Key", "description": "Update a API Key given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "API Key to be updated", "required": true, "content": { "application/json": { "schema": { "type": "object", "allOf": [ { "description": "API Key Update Config", "type": "object", "properties": { "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } } ] } } } }, "tags": [ "API Keys" ], "parameters": [ { "in": "path", "name": "appname", "schema": { "type": "string" }, "required": true, "description": "String appname of the API Key to get" } ], "responses": { "200": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "appkey": { "type": "string", "readOnly": true, "description": "The API Key", "example": "fMBQnzyGRnHuTEjhOclqZwHTPh7dBP1MkZtV" } } }, { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/customers/types": { "get": { "operationId": "v1_customers_types_get", "summary": "List Account Types", "description": "Return a list of all Accounts Types.", "tags": [ "Resellers" ], "responses": { "200": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Account type objects.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "value": { "description": "The account type value. immutable.", "enum": [ "customer", "reseller", "staff" ], "type": "string" }, "label": { "description": "The account type label.", "type": "string" }, "description": { "description": "Additional information to help describe the account type.", "type": "string" } } } } } }, "example": { "meta": { "code": 200, "count": 3 }, "data": [ { "value": "customer", "label": "Customer", "description": "Standard account type. (default)" }, { "value": "reseller", "label": "Reseller", "description": "Sub account will also be considered a reseller, in which they can have their own sub accounts." }, { "value": "staff", "label": "Staff/Internal", "description": "Denotes that the account is not a customer, but rather in use for testing or sales, etc." } ] } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/customers": { "get": { "operationId": "v1_customers_get", "summary": "List Accounts", "description": "Return a list of all Accounts for the reseller.", "tags": [ "Resellers" ], "responses": { "200": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/customer": { "post": { "operationId": "v1_customer_post", "summary": "Create Account", "description": "Create an Account (sub customer) the supplied object. Do NOT submit an ID. IDs are auto generated and immutable.", "requestBody": { "description": "Account to be added", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "shortname", "organization", "type", "retention", "rollupRetention", "username", "given_name", "family_name" ], "additionalProperties": false, "properties": { "shortname": { "description": "Shortname of the organization. 5-16 chars max. RFC 3986 characters only.", "type": "string", "example": "netography" }, "organization": { "description": "Name of the organization", "type": "string", "example": "Netography, Inc." }, "type": { "description": "Account Type. See Account Types", "type": "string", "example": "customer" }, "trial": { "type": "boolean", "description": "Whether or not this is a trial account", "example": false }, "retention": { "type": "integer", "description": "Data retention", "enum": [ 7, 45, 90, 180 ], "example": 90 }, "rollupRetention": { "type": "integer", "description": "Rollup Data Retention. Should be >= retention.", "enum": [ 7, 90, 180, 365 ], "example": 180 }, "fps": { "type": "integer", "description": "Optional. Contractual Flows per Second for the account", "example": 10000 }, "username": { "type": "string", "description": "Email address of the 1st admin user", "example": "no-reply@netography.com" }, "given_name": { "type": "string", "description": "First or Given name of the 1st admin user", "example": "Skippy" }, "family_name": { "type": "string", "description": "Last or Family name of the 1st admin user", "example": "Longbottom" } } } } } }, "tags": [ "Resellers" ], "responses": { "201": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/customer/{shortname}": { "get": { "operationId": "v1_customer_shortname_get", "summary": "Get Account", "description": "Fetches a specific Account from the shortname supplied in the path.", "tags": [ "Resellers" ], "parameters": [ { "in": "path", "name": "shortname", "schema": { "type": "string" }, "required": true, "description": "String identifier of the customer" } ], "responses": { "200": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_customer_shortname_put", "summary": "Update Account", "description": "Update an Account given the provided object. This does not do a diff. You must send the complete object.", "requestBody": { "description": "Account to be updated", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "organization", "type", "retention", "rollupRetention" ], "additionalProperties": false, "properties": { "organization": { "description": "Name of the organization", "type": "string", "example": "Netography, Inc." }, "type": { "description": "Account Type. See Account Types", "type": "string", "example": "customer" }, "trial": { "type": "boolean", "description": "Whether or not this is a trial account", "example": false }, "retention": { "type": "integer", "description": "Data retention", "enum": [ 7, 45, 90, 180 ], "example": 90 }, "rollupRetention": { "type": "integer", "description": "Rollup Data Retention. Should be >= retention.", "enum": [ 7, 90, 180, 365 ], "example": 180 }, "fps": { "type": "integer", "description": "Optional. Contractual Flows per Second for the account", "example": 10000 } } } } } }, "tags": [ "Resellers" ], "parameters": [ { "name": "shortname", "in": "path", "required": true, "description": "The shortname of the Account to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_customer_shortname_delete", "summary": "Delete Account", "description": "Deletes the Account.", "tags": [ "Resellers" ], "parameters": [ { "name": "shortname", "in": "path", "required": true, "description": "The shortname of the User to be retrieved", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/customer/access-allowed-ips": { "get": { "operationId": "v1_customer_access_allowed_ips", "summary": "Get Allowed IPs", "description": "Fetches the IPs from KeyCloak that are allowed to access Fusion", "tags": [ "Settings - Security" ], "responses": { "200": { "description": "Access Allowed IP List from KeyCloak", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" }, "example": [ "1.1.1.1", "2.2.2.2", "3.3.3.3/16" ] } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_customer_access_allowed_ips_put", "summary": "Update Allowed IPs", "description": "Updates the IPs within KeyCloak that are allowed to access Fusion", "tags": [ "Settings - Security" ], "requestBody": { "description": "Array of IPs to be updated within KeyCloak", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" }, "example": [ "1.1.1.1", "2.2.2.2", "3.3.3.3/16" ] } } } }, "responses": { "201": { "description": "Access Allowed IP List from KeyCloak", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" }, "example": [ "1.1.1.1", "2.2.2.2", "3.3.3.3/16" ] } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithms": { "get": { "operationId": "v1_traffic_detection_models_get", "summary": "List Traffic Detection Models", "description": "Returns an array of Traffic Detection Models.", "tags": [ "Detect and Respond - Traffic Detection Models" ], "responses": { "200": { "description": "List of Requested Traffic Detection Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithm": { "post": { "operationId": "v1_traffic_detection_model_post", "summary": "Create Traffic Detection Model", "description": "Creates a traffic detection model from the data that's been supplied. Do not provide an id. IDs are auto generated", "tags": [ "Detect and Respond - Traffic Detection Models" ], "requestBody": { "description": "Traffic Detection Model to be added", "required": true, "content": { "application/json": { "schema": { "description": "Traffic Detection Model Create or Update Config", "type": "object", "required": [ "categories", "description", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] } } } }, "responses": { "201": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithm/{id}": { "get": { "operationId": "v1_traffic_detection_model_id_get", "summary": "Fetch Traffic Detection Model", "description": "Fetches a specific traffic detection model from the ID supplied in the path.", "tags": [ "Detect and Respond - Traffic Detection Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_traffic_detection_model_id_put", "summary": "Update Traffic Detection Model", "description": "Update a traffic detection model given the provided object. This does not do a diff. You must send the complete object.", "tags": [ "Detect and Respond - Traffic Detection Models" ], "requestBody": { "description": "Traffic detection model to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Traffic Detection Model Create or Update Config", "type": "object", "required": [ "categories", "description", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_traffic_detection_model_id_delete", "summary": "Delete Traffic Detection Model", "description": "Deletes a traffic detection model", "tags": [ "Detect and Respond - Traffic Detection Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithm/{id}/enable": { "put": { "operationId": "v1_traffic_detection_model_id_enable_put", "summary": "Enable Traffic Detection Model", "description": "Enables a traffic detection model", "tags": [ "Detect and Respond - Traffic Detection Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be enabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithm/{id}/disable": { "put": { "operationId": "v1_traffic_detection_model_id_disable_put", "summary": "Disable Traffic Detection Model", "description": "Disables a traffic detection model", "tags": [ "Detect and Respond - Traffic Detection Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be disabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/algorithm/{id}/reset": { "put": { "operationId": "v1_traffic_detection_model_id_reset_put", "summary": "Reset Traffic Detection Model", "description": "Resets a customized system traffic detection model", "tags": [ "Detect and Respond - Traffic Detection Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the traffic detection model to be reseted", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccms": { "get": { "operationId": "v1_context_creation_models_get", "summary": "List Context Creation Models", "description": "Returns an array of Context Creation Models.", "tags": [ "Detect and Respond - Context Creation Models" ], "responses": { "200": { "description": "List of Requested Context Creation Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccm": { "post": { "operationId": "v1_context_creation_model_post", "summary": "Create Context Creation Model", "description": "Creates a context creation model from the data that's been supplied. Do not provide an id. IDs are auto generated", "tags": [ "Detect and Respond - Context Creation Models" ], "requestBody": { "description": "Context Creation Model to be added", "required": true, "content": { "application/json": { "schema": { "description": "Context Creation Model Create or Update Config", "type": "object", "required": [ "description", "expiration", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] } } } }, "responses": { "201": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccm/{id}": { "get": { "operationId": "v1_context_creation_model_id_get", "summary": "Fetch Context Creation Model", "description": "Fetches a specific context creation model from the ID supplied in the path.", "tags": [ "Detect and Respond - Context Creation Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_context_creation_model_id_put", "summary": "Update Context Creation Model", "description": "Update a context creation model given the provided object. This does not do a diff. You must send the complete object.", "tags": [ "Detect and Respond - Context Creation Models" ], "requestBody": { "description": "Context creation model to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Context Creation Model Create or Update Config", "type": "object", "required": [ "description", "expiration", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_context_creation_model_id_delete", "summary": "Delete Context Creation Model", "description": "Deletes a context creation model", "tags": [ "Detect and Respond - Context Creation Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccm/{id}/enable": { "put": { "operationId": "v1_context_creation_model_id_enable_put", "summary": "Enable Context Creation Model", "description": "Enables a context creation model", "tags": [ "Detect and Respond - Context Creation Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be enabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccm/{id}/disable": { "put": { "operationId": "v1_context_creation_model_id_disable_put", "summary": "Disable Context Creation Model", "description": "Disables a context creation model", "tags": [ "Detect and Respond - Context Creation Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be disabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/ccm/{id}/reset": { "put": { "operationId": "v1_context_creation_model_id_reset_put", "summary": "Reset Context Creation Model", "description": "Resets a customized system context creation model", "tags": [ "Detect and Respond - Context Creation Models" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the context creation model to be reseted", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/categories": { "get": { "operationId": "v1_detection_categories_get", "summary": "List Detection Categories", "description": "Returns an array of Detection Categories.", "tags": [ "Detect and Respond - Detection Categories" ], "responses": { "200": { "description": "List of Requested Detection Categories", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_detection_categories_delete", "summary": "Delete All Custom Detection Categories", "description": "Deletes all custom detection categories.", "tags": [ "Detect and Respond - Detection Categories" ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/category/{name}": { "get": { "operationId": "v1_detection_category_name_get", "summary": "Fetch Detection Category", "description": "Fetches a specific detection category from the NAME supplied in the path.", "tags": [ "Detect and Respond - Detection Categories" ], "parameters": [ { "name": "name", "in": "path", "required": true, "description": "The NAME of the detection category to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Detection Category", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_detection_category_name_put", "summary": "Create or Update Detection Category", "description": "Create or update a detection category given the provided object.", "tags": [ "Detect and Respond - Detection Categories" ], "requestBody": { "description": "Context creation model to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Detection Category Create or Update Config", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" } } } } } }, "parameters": [ { "name": "name", "in": "path", "required": true, "description": "The NAME of the detection category to be created or updeted.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Detection Category", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_detection_category_name_delete", "summary": "Delete Detection Model", "description": "Deletes a detection model", "tags": [ "Detect and Respond - Detection Categories" ], "parameters": [ { "name": "name", "in": "path", "required": true, "description": "The NAME of the detection category to be deleted.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/rules": { "get": { "operationId": "v1_response_policies_get", "summary": "List Response Policies", "description": "Returns an array of Response Policies.", "tags": [ "Detect and Respond - Response Policies" ], "responses": { "200": { "description": "List of Requested Response Policies", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/rule": { "post": { "operationId": "v1_response_policy_post", "summary": "Create Response Policy", "description": "Creates a response policy from the data that's been supplied.", "tags": [ "Detect and Respond - Response Policies" ], "requestBody": { "description": "Response Policy to be added", "required": true, "content": { "application/json": { "schema": { "description": "Response Policy Create or Update Config", "type": "object", "required": [ "name" ], "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "plugins": { "type": "array", "items": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "214365f7-ac9a-45bc-9795-95958bdfa694" } } } } } } }, "responses": { "201": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/rule/{id}": { "get": { "operationId": "v1_response_policy_id_get", "summary": "Fetch Response Policy", "description": "Fetches a specific response policy from the ID supplied in the path.", "tags": [ "Detect and Respond - Response Policies" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response policy to be returned.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_response_policy_id_put", "summary": "Update Response Policy", "description": "Update a response policy given the provided object. This does not do a diff. You must send the complete object.", "tags": [ "Detect and Respond - Response Policies" ], "requestBody": { "description": "Response Policy to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Response Policy Create or Update Config", "type": "object", "required": [ "name" ], "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "plugins": { "type": "array", "items": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "214365f7-ac9a-45bc-9795-95958bdfa694" } } } } } } }, "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response policy to be updated", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_response_policy_id_delete", "summary": "Delete Response Policy", "description": "Deletes a response policy", "tags": [ "Detect and Respond - Response Policies" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response policy to be deleted", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/rule/{id}/enable": { "put": { "operationId": "v1_response_policy_id_enable_put", "summary": "Enable Response Policy", "description": "Enables a response policy", "tags": [ "Detect and Respond - Response Policies" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response policy to be enabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/rule/{id}/disable": { "put": { "operationId": "v1_response_policy_id_disable_put", "summary": "Disable Response Policy", "description": "Disables a response policy", "tags": [ "Detect and Respond - Response Policies" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the response policy to be disabled", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/triggers": { "get": { "operationId": "v1_threshold_overrides_get", "summary": "List Threshold Overrides", "description": "Returns an array of Threshold Overrides.", "tags": [ "Detect and Respond - Threshold Overrides" ], "responses": { "200": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_threshold_overrides_put", "summary": "Create or Update Threshold Overrides", "description": "Create or update threshold overrides given the provided object.", "tags": [ "Detect and Respond - Threshold Overrides" ], "requestBody": { "description": "Threshold overrides to be updated", "required": true, "content": { "application/json": { "schema": { "description": "Threshold Override Create or Update Config", "type": "object", "required": [ "algorithm", "rollupperiod", "thresholds", "track", "updateinterval" ], "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } }, "responses": { "200": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_threshold_overrides_delete", "summary": "Delete All Threshold Overrides", "description": "Deletes custom threshold overrides.", "tags": [ "Detect and Respond - Threshold Overrides" ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/triggers/algorithms/{algorithm}": { "get": { "operationId": "v1_threshold_overrides_algorithm_get", "summary": "List Threshold Overrides for Algorithm", "description": "Returns an array of Threshold Overrides for the specified algorithm.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "algorithm", "in": "path", "required": true, "description": "The algorithm to fetch threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_threshold_overrides_algorithm_delete", "summary": "Delete Threshold Overrides for Algorithm", "description": "Deletes threshold overrides for the specified algorithm.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "algorithm", "in": "path", "required": true, "description": "The algorithm to delete threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/triggers/objects/{object}": { "get": { "operationId": "v1_threshold_overrides_object_get", "summary": "List Threshold Overrides for Object", "description": "Returns an array of Threshold Overrides for the specified object.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "object", "in": "path", "required": true, "description": "The object to fetch threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_threshold_overrides_object_delete", "summary": "Delete Threshold Overrides for Object", "description": "Deletes threshold overrides for the specified object.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "object", "in": "path", "required": true, "description": "The object to delete threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/rule-engine/triggers/algorithms/{algorithm}/objects/{object}": { "get": { "operationId": "v1_threshold_overrides_algorithm_object_get", "summary": "List Threshold Overrides for Algorithm and Object", "description": "Returns an array of Threshold Overrides for the specified algorithm and object.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "algorithm", "in": "path", "required": true, "description": "The algorithm to fetch threshold overrides for.", "schema": { "type": "string" } }, { "name": "object", "in": "path", "required": true, "description": "The object to fetch threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_threshold_overrides_algorithm_object_delete", "summary": "Delete Threshold Overrides for Algorithm and Object", "description": "Deletes threshold overrides for the specified algorithm and object.", "tags": [ "Detect and Respond - Threshold Overrides" ], "parameters": [ { "name": "algorithm", "in": "path", "required": true, "description": "The algorithm to delete threshold overrides for.", "schema": { "type": "string" } }, { "name": "object", "in": "path", "required": true, "description": "The object to delete threshold overrides for.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty array" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbors": { "get": { "operationId": "v1_bgp_neighbors_get", "summary": "List BGP Neighbors", "description": "Returns an array of BGP Neighbors.", "tags": [ "Traffic Sources - Devices" ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbors/devices/{deviceid}": { "get": { "operationId": "v1_bgp_neighbors_devices_deviceid_get", "summary": "List BGP Neighbors for a Device", "description": "Returns an array of BGP Neighbors for a Device.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "in": "path", "name": "deviceid", "required": true, "schema": { "type": "string" }, "description": "The ID of the device to retrieve BGP Neighbors for." } ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbor": { "post": { "operationId": "v1_bgp_neighbor_post", "summary": "Create BGP Neighbor", "description": "Create a new BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "requestBody": { "description": "BGP Neighbor to be added", "required": true, "content": { "application/json": { "schema": { "description": "BGP Neighbor Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "required": [ "addressremote", "description", "asn" ] } } } }, "responses": { "201": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbor/{neighborid}": { "get": { "operationId": "v1_bgp_neighbors_neighborid_get", "summary": "Get BGP Neighbor", "description": "Returns the details of a specific BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "in": "path", "name": "neighborid", "required": true, "schema": { "type": "string" }, "description": "The ID of the BGP Neighbor to retrieve." } ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_bgp_neighbors_neighborid_put", "summary": "Update BGP Neighbor", "description": "Updates the details of a specific BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "requestBody": { "description": "BGP Neighbor to be updated.", "required": true, "content": { "application/json": { "schema": { "description": "BGP Neighbor Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "required": [ "addressremote", "description", "asn" ] } } } }, "parameters": [ { "in": "path", "name": "neighborid", "required": true, "schema": { "type": "string" }, "description": "The ID of the BGP Neighbor to update." } ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_bgp_neighbors_neighborid_delete", "summary": "Delete BGP Neighbor", "description": "Deletes a specific BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "in": "path", "name": "neighborid", "required": true, "schema": { "type": "string" }, "description": "The ID of the BGP Neighbor to delete." } ], "responses": { "204": { "description": "Empty Response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbor/{neighborid}/enable": { "put": { "operationId": "v1_bgp_neighbors_neighborid_enable_put", "summary": "Enable BGP Neighbor", "description": "Enable a specific BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "in": "path", "name": "neighborid", "required": true, "schema": { "type": "string" }, "description": "The ID of the BGP Neighbor to enable." } ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/bgp/neighbor/{neighborid}/disable": { "put": { "operationId": "v1_bgp_neighbors_neighborid_disable_put", "summary": "Disable BGP Neighbor", "description": "Disable a specific BGP Neighbor.", "tags": [ "Traffic Sources - Devices" ], "parameters": [ { "in": "path", "name": "neighborid", "required": true, "schema": { "type": "string" }, "description": "The ID of the BGP Neighbor to disable." } ], "responses": { "200": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/netclasses": { "get": { "operationId": "v1_netclasses_get", "summary": "List Network Classifications", "description": "Returns an array of Network Classifications.", "tags": [ "Settings - Traffic Classification" ], "responses": { "200": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/netclass/{type}": { "get": { "operationId": "v1_netclass_type_get", "summary": "Get Network Classification", "description": "Returns a Network Classification by type.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "type", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The type of network classification." } ], "responses": { "200": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_netclass_type_put", "summary": "Update Network Classification", "description": "Updates a Network Classification by type.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "type", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The type of network classification." } ], "requestBody": { "description": "Network Classification to be updated.", "required": true, "content": { "application/json": { "schema": { "description": "Network Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "required": [ "networks", "privatenets" ] } } } }, "responses": { "200": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_netclass_type_delete", "summary": "Delete Network Classification", "description": "Deletes a Network Classification by type.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "type", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The type of network classification." } ], "responses": { "204": { "description": "Empty Response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dnsclasses": { "get": { "operationId": "v1_dnsclasses_get", "summary": "List DNS Classifications", "description": "Returns an array of DNS Classifications.", "tags": [ "Settings - Traffic Classification" ], "responses": { "200": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dnsclass/{id}": { "get": { "operationId": "v1_dnsclass_id_get", "summary": "Get DNS Classification", "description": "Returns a DNS Classification by type.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The id of dns classification." } ], "responses": { "200": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_dnsclass_id_put", "summary": "Update DNS Classification", "description": "Updates a DNS Classification by type.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The id of dns classification." } ], "requestBody": { "description": "DNS Classification to be updated.", "required": true, "content": { "application/json": { "schema": { "description": "DNS Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "required": [ "domains" ] } } } }, "responses": { "200": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_dnsclass_id_delete", "summary": "Delete DNS Classification", "description": "Deletes a DNS Classification by id.", "tags": [ "Settings - Traffic Classification" ], "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" }, "description": "The id of dns classification." } ], "responses": { "204": { "description": "Empty Response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/thresholder/automaton": { "get": { "operationId": "v1_thresholder_automaton_get", "summary": "Get all threshold automaton configs", "description": "Returns all auto-threshold automaton configs configured for all DMs in a given customer.", "tags": [ "Auto Thresholds" ], "responses": { "200": { "description": "List of threshold automaton configs for a customer", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_thresholder_automaton_algorithm_post", "summary": "Update threshold automaton config", "description": "Updates the auto-threshold automaton config for a given detection model.", "tags": [ "Auto Thresholds" ], "requestBody": { "description": "Automaton config to be updated.", "required": true, "content": { "application/json": { "schema": { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } } } }, "responses": { "200": { "description": "Threshold Automaton config", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/thresholder/automaton/{algorithm}": { "get": { "operationId": "v1_thresholder_automaton_algorithm_get", "summary": "Get threshold automaton config", "description": "Returns the auto-threshold automaton config for a detection model", "tags": [ "Auto Thresholds" ], "parameters": [ { "in": "path", "name": "algorithm", "required": true, "schema": { "type": "string" }, "description": "The name of the detection model to fetch automaton config for" } ], "responses": { "200": { "description": "Threshold Automaton config", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_thresholder_automaton_algorithm_delete", "summary": "Delete automaton config", "description": "Deletes the threshold automaton config for a given detection model", "tags": [ "Auto Thresholds" ], "parameters": [ { "in": "path", "name": "algorithm", "required": true, "schema": { "type": "string" }, "description": "The name of the detection model to delete." } ], "responses": { "204": { "description": "Empty Response" }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "patch": { "operationId": "v1_thresholder_automaton_algorithm_patch", "summary": "Update threshold automaton config specific value", "description": "Updates specific values in the auto-threshold automaton config for a given detection model.", "tags": [ "Auto Thresholds" ], "parameters": [ { "in": "path", "name": "algorithm", "required": true, "schema": { "type": "string" }, "description": "The name of the detection model to update." } ], "requestBody": { "description": "Automaton config values to be updated.", "required": true, "content": { "application/json": { "schema": { "description": "Threshold Automaton Record", "type": "object", "anyOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ] } } } }, "responses": { "200": { "description": "Threshold Automaton config", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/thresholder/automaton/{algorithm}/trackby/{track}": { "get": { "operationId": "v1_thresholder_automaton_algorithm_trackby_get", "summary": "Get track values", "description": "Returns auto-threshold track data for the given track", "tags": [ "Auto Thresholds" ], "parameters": [ { "in": "path", "name": "algorithm", "required": true, "schema": { "type": "string" }, "description": "The name of the detection model to fetch track data for" }, { "in": "path", "name": "track", "required": true, "schema": { "type": "string" }, "description": "The name of the track (group) to fetch data for" }, { "in": "query", "name": "from", "required": true, "schema": { "type": "number" }, "description": "Unix timestamp defining the start of the data range to query" }, { "in": "query", "name": "to", "required": true, "schema": { "type": "number" }, "description": "Unix timestamp defining the end of the data range to query" } ], "responses": { "200": { "description": "List of track values for a given auto threshold", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "average": { "type": "number", "description": "average value for operation", "example": 5176 }, "deviation": { "type": "number", "example": 2741552.2677988047 }, "operation": { "type": "string", "example": "AVERAGE(bits)" }, "threshold": { "type": "array", "description": "array holding values for each configured severity level for the data point.", "items": { "type": "object", "properties": { "level": { "type": "string", "example": "low" }, "value": { "type": "number", "example": 3028123.4945786856 } } } }, "customer": { "type": "string", "description": "Netography customer shortname", "example": "xpertdns" }, "group": { "type": "string", "description": "the specific track (group) the data corresponds to.", "example": "10.99.4.13" }, "algorithm": { "type": "string", "description": "the detection model the threshold values are derived from", "example": "1ms0rryminer_detection" }, "timestamp": { "type": "number", "description": "unix timestamp describing when the threshold values were generated", "example": 1725449961304 } } } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/mitre/tactics": { "get": { "operationId": "v1_mitre_tactics_get", "summary": "List MITRE tactics", "description": "Returns an array of MITRE tactics", "tags": [ "MITRE ATT&CK" ], "responses": { "200": { "description": "List of MITRE Tactics with Techniques", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "description": "MITRE ATT&CK Tactic Record", "type": "object", "properties": { "tactic_name": { "type": "string", "example": "Reconnaissance" }, "tactic_id": { "type": "string", "example": "TA0043" }, "techniques": { "type": "array", "items": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/mitre/tactics/{tactic_id}": { "get": { "operationId": "v1_mitre_tactic_id_get", "summary": "List MITRE techniques for a given tactic", "description": "Returns an array of MITRE techniques for a given tactic", "tags": [ "MITRE ATT&CK" ], "parameters": [ { "name": "tactic_id", "in": "path", "required": true, "description": "The ID of the tactic to fetch techniques for", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Techniques for a Specific MITRE Tactic", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dns-devices": { "get": { "operationId": "v1_dns_devices_get", "summary": "Get All DNS Devices", "description": "Returns a list of all DNS devices.", "tags": [ "Traffic Sources - DNS Devices" ], "responses": { "200": { "description": "List of Requested DNS Devices", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "post": { "operationId": "v1_dns_devices_post", "summary": "Add DNS Device", "description": "Adds a new DNS device.", "tags": [ "Traffic Sources - DNS Devices" ], "requestBody": { "description": "DNS device to be added.", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "name", "type", "site", "enabled" ], "properties": { "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } } } } } }, "responses": { "201": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dns-devices/{id}": { "get": { "operationId": "v1_dns_device_id_get", "summary": "Get DNS Device By ID", "description": "Fetches a specific DNS device by ID.", "tags": [ "Traffic Sources - DNS Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the DNS device to fetch.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "put": { "operationId": "v1_dns_device_id_put", "summary": "Update DNS Device By ID", "description": "Updates a DNS device by ID.", "tags": [ "Traffic Sources - DNS Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the DNS device to update.", "schema": { "type": "string" } } ], "requestBody": { "description": "DNS device to be updated.", "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "name", "type", "site", "enabled" ], "properties": { "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } } } } } }, "responses": { "200": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } }, "delete": { "operationId": "v1_dns_device_id_delete", "summary": "Delete DNS Device By ID", "description": "Deletes a DNS device by ID.", "tags": [ "Traffic Sources - DNS Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the DNS device to delete.", "schema": { "type": "string" } } ], "responses": { "204": { "description": "An empty response." }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dns-devices/bulkdelete": { "put": { "operationId": "v1_dns_devices_bulkdelete_put", "summary": "Bulk Delete DNS Devices", "description": "Deletes multiple DNS devices in bulk.", "tags": [ "Traffic Sources - DNS Devices" ], "requestBody": { "description": "List of DNS device IDs to delete.", "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" } } } } }, "responses": { "204": { "description": "An empty response." }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dns-devices/{id}/enable": { "put": { "operationId": "v1_dns_device_id_enable_put", "summary": "Enable DNS Device By ID", "description": "Enables a DNS device by ID.", "tags": [ "Traffic Sources - DNS Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the DNS device to enable.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } }, "/api/v1/dns-devices/{id}/disable": { "put": { "operationId": "v1_dns_device_id_disable_put", "summary": "Disable DNS Device By ID", "description": "Disables a DNS device by ID.", "tags": [ "Traffic Sources - DNS Devices" ], "parameters": [ { "name": "id", "in": "path", "required": true, "description": "The ID of the DNS device to disable.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "400": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "401": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "403": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "default": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } } } } } }, "components": { "schemas": { "error": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "alert_record": { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, "audit_record": { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, "block_record": { "description": "Block Record", "type": "object" }, "dns_record": { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, "flow_record": { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } }, "search_config": { "type": "object", "required": [ "start", "end" ], "description": "Search configuration schema for querying data. This schema defines the parameters used to filter and retrieve records from a dataset.", "additionalProperties": false, "properties": { "start": { "description": "When the search should begin. Timestamp or negative number of seconds to look back.", "type": "integer", "example": -7200 }, "end": { "description": "When the search should end. Timestamp, 0 for now or negative number of seconds to look back.", "type": "integer", "example": 0 }, "size": { "description": "Number of results to return. To avoid timeouts on large datasets, we recommend setting this value.", "type": "integer", "example": 100 }, "from": { "description": "Used in pagination. Combination of from + size", "type": "integer" }, "include": { "description": "Array of fields you want returned as part of the records. Default is ALL fields.", "type": "array", "items": { "type": "string" }, "maxItems": 100 }, "search": { "description": "A NQL search filter for constraining the dataset.", "type": "string", "example": "bits > 1000" } } }, "format": { "title": "format", "description": "Series data can be provided in a variety of formats which are native to some charting libraries. e.g. amcharts or highcharts", "type": "string", "default": "highcharts", "enum": [ "amcharts", "d3", "highcharts", "png" ], "example": "highcharts" }, "timeseries_series": { "type": "object", "description": "Configuration for a time series data query that defines how to aggregate and analyze network traffic data over time. Each series specifies the metric to measure, fields to group by, time intervals, and filtering criteria to generate meaningful analytics insights.", "required": [ "name", "metric", "size", "field" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-series-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5 }, "ipagg": { "type": "object", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8 }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset.", "items": { "type": "string" }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "format": "int32", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc" } } }, "aggregation_series": { "type": "object", "description": "Configuration for a data aggregation series used in analytics queries. Defines how to group, filter, and aggregate data with various options for fields, metrics, and time intervals.", "required": [ "name", "metric" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-agg-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5, "minimum": 1, "maximum": 2147483647, "format": "int32" }, "ipagg": { "type": "object", "description": "IP aggregation configuration for grouping IP addresses by CIDR blocks.", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8, "minimum": 8, "maximum": 32, "format": "int32" }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`", "example": "srcip" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset. Only one search is allowed for aggregation series.", "items": { "type": "string", "description": "NQL query string for filtering data." }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc", "enum": [ "asc", "desc" ], "example": "desc" } } }, "asn_record": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "ip_record": { "type": "object", "additionalProperties": false, "properties": { "bogon": { "description": "Is a bogon or not", "type": "boolean", "example": false }, "ip": { "description": "IP Address", "type": "string", "example": "1.0.0.32" }, "firstseen": { "description": "Timestamp of first time this ip address was seen.", "type": "integer", "example": 1617980476 }, "lastseen": { "description": "Timestamp of last time this ip address was seen.", "type": "integer", "example": 1617991633 }, "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "iprep": { "description": "Object with ip reputation information", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "categories": { "type": "array", "description": "Array of geo reputation categories this ip address has been flagged in.", "maxItems": 1000, "items": { "type": "string", "example": "ddos" } } } }, "geo": { "description": "Object with geographic location information", "type": "object" }, "as": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "rdns": { "description": "Reverse DNS", "type": "string", "example": false }, "pdns": { "description": "Protective DNS", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "records": { "type": "array", "description": "Array of PDNS records", "maxItems": 1000, "items": { "type": "string" } } } } } }, "label_ip": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } }, "label_ip_delete": { "description": "Delete IP Labels via ip or context or both. One of ip or context is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address.", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. Default context is 'name'. Optional if ip is provided.", "type": "string", "example": "name" } } }, "label_port_record": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } }, "label_port_config": { "description": "Port Label Create Config", "type": "object", "required": [ "protocol", "port", "labels" ], "additionalProperties": false, "properties": { "protocol": { "description": "Protocol.", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } }, "label_port_delete": { "description": "Delete Port Labels via port or protocol or both. One of port or protocol is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "port": { "description": "Port. Optional if protocol is provided.", "type": "number", "example": 1 }, "protocol": { "description": "Protocol. Optional is port is provided.", "type": "string", "example": "udp" } } }, "device_config": { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } }, "vpc_config_aws_kinesis": { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "vpc_config_aws_s3": { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, "vpc_config_azure_blobstorage": { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "vpc_config_gcp": { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "vpc_config_ibm_objectstorage": { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "vpc_config_oracle_objectstorage": { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "vpc_config_azure_vnet_blobstorage": { "description": "Azure VNet Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networkwatcher", "resourcegroup", "subscriptionid", "flowlog" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure-vnet" ], "example": "azure-vnet" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of this flow source in Netography Fusion. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "Enable or disable polling the cloud provider for samples", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account Name where flow logs are stored", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n", "example": "insights-logs-flowlogflowevent" }, "networkwatcher": { "type": "string", "description": "Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n", "example": "NetworkWatcher_eastus" }, "resourcegroup": { "type": "string", "description": "Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n", "example": "NETWORKWATCHERRG" }, "flowlog": { "type": "string", "description": "Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n", "example": "flowlog-eastus-prod" }, "subscriptionid": { "type": "string", "description": "Network Watcher Subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "integrations_context_aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "integrations_context_azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "integrations_context_crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "integrations_context_crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "integrations_context_ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "integrations_context_oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "integrations_context_gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "integrations_context_s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "integrations_context_sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "integrations_context_wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } }, "integrations_context": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] }, "integrations_response_bgp": { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "integrations_response_blocklist": { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, "integrations_response_crowdstrike": { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, "integrations_response_email": { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, "integrations_response_flowspec": { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "integrations_response_flowspec_custom": { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "integrations_response_ns1": { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, "integrations_response_pagerduty": { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, "integrations_response_route53": { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, "integrations_response_rtbh": { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "integrations_response_slack": { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, "integrations_response_syslog": { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, "integrations_response_teams": { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, "integrations_response_twilio": { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, "integrations_response_webhook": { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } }, "integrations_response": { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] }, "flow_tag_config": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } }, "permission_record": { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } }, "role_config": { "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the role.", "type": "string", "example": "my_role" }, "description": { "description": "A user friendly description of the role.", "type": "string", "example": "Role for Testing" }, "canMasquerade": { "description": "(resellers only) Whether or not the role can masquerade into sub accounts.", "type": "boolean", "example": true, "default": false }, "canSendFlow": { "description": "Whether or not the role can send NetoFlow.", "type": "boolean", "example": true, "default": false }, "permissions": { "type": "array", "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] }, "example": [ { "resource": "account", "fetch": true, "create": true, "update": true, "delete": true }, { "resource": "customer", "fetch": true, "create": false, "update": false, "delete": false } ] } } }, "user_config": { "required": [ "given_name", "family_name", "email", "roles" ], "additionalProperties": false, "properties": { "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "admin" ] } } }, "api_key_record": { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } }, "api_key_config_create": { "description": "API Key Create Config", "type": "object", "required": [ "appname", "roles" ], "properties": { "appname": { "description": "API Key Name", "type": "string", "example": "my_application" }, "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } }, "api_key_config_update": { "description": "API Key Update Config", "type": "object", "properties": { "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } }, "account_record": { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } }, "traffic_detection_model_common": { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } }, "traffic_detection_model_record": { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } }, "traffic_detection_model_config": { "description": "Traffic Detection Model Create or Update Config", "type": "object", "required": [ "categories", "description", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] }, "context_creation_model_common": { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } }, "context_creation_model_record": { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } }, "context_creation_model_config": { "description": "Context Creation Model Create or Update Config", "type": "object", "required": [ "description", "expiration", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] }, "detection_category_record": { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } }, "detection_category_config": { "description": "Detection Category Create or Update Config", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" } } }, "response_policy_common": { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } }, "response_policy_record": { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } }, "response_policy_config": { "description": "Response Policy Create or Update Config", "type": "object", "required": [ "name" ], "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "plugins": { "type": "array", "items": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "214365f7-ac9a-45bc-9795-95958bdfa694" } } } }, "threshold_override_record": { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } }, "threshold_override_config": { "description": "Threshold Override Create or Update Config", "type": "object", "required": [ "algorithm", "rollupperiod", "thresholds", "track", "updateinterval" ], "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] }, "bgp_neighbor_common": { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } }, "bgp_neighbor_record": { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } }, "bgp_neighbor_config": { "description": "BGP Neighbor Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "required": [ "addressremote", "description", "asn" ] }, "netclass_common": { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } }, "netclass_record": { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } }, "netclass_config": { "description": "Network Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "required": [ "networks", "privatenets" ] }, "dnsclass_common": { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } }, "dnsclass_record": { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } }, "dnsclass_config": { "description": "DNS Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "required": [ "domains" ] }, "threshold_automaton_config": { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } }, "threshold_automaton_record": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } }, "threshold_automaton_patch_config": { "description": "Threshold Automaton Record", "type": "object", "anyOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ] }, "threshold_track_value": { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "average": { "type": "number", "description": "average value for operation", "example": 5176 }, "deviation": { "type": "number", "example": 2741552.2677988047 }, "operation": { "type": "string", "example": "AVERAGE(bits)" }, "threshold": { "type": "array", "description": "array holding values for each configured severity level for the data point.", "items": { "type": "object", "properties": { "level": { "type": "string", "example": "low" }, "value": { "type": "number", "example": 3028123.4945786856 } } } }, "customer": { "type": "string", "description": "Netography customer shortname", "example": "xpertdns" }, "group": { "type": "string", "description": "the specific track (group) the data corresponds to.", "example": "10.99.4.13" }, "algorithm": { "type": "string", "description": "the detection model the threshold values are derived from", "example": "1ms0rryminer_detection" }, "timestamp": { "type": "number", "description": "unix timestamp describing when the threshold values were generated", "example": 1725449961304 } } }, "mitre_technique_record": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } }, "mitre_tactic_record": { "description": "MITRE ATT&CK Tactic Record", "type": "object", "properties": { "tactic_name": { "type": "string", "example": "Reconnaissance" }, "tactic_id": { "type": "string", "example": "TA0043" }, "techniques": { "type": "array", "items": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } } } } }, "dns_device_record": { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] }, "AccountRecord": { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } }, "AggregationSeries": { "type": "object", "description": "Configuration for a data aggregation series used in analytics queries. Defines how to group, filter, and aggregate data with various options for fields, metrics, and time intervals.", "required": [ "name", "metric" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-agg-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5, "minimum": 1, "maximum": 2147483647, "format": "int32" }, "ipagg": { "type": "object", "description": "IP aggregation configuration for grouping IP addresses by CIDR blocks.", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8, "minimum": 8, "maximum": 32, "format": "int32" }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`", "example": "srcip" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset. Only one search is allowed for aggregation series.", "items": { "type": "string", "description": "NQL query string for filtering data." }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc", "enum": [ "asc", "desc" ], "example": "desc" } } }, "AlertRecord": { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, "ApiKeyConfigCreate": { "description": "API Key Create Config", "type": "object", "required": [ "appname", "roles" ], "properties": { "appname": { "description": "API Key Name", "type": "string", "example": "my_application" }, "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } }, "ApiKeyConfigUpdate": { "description": "API Key Update Config", "type": "object", "properties": { "description": { "description": "API Key Description", "type": "string", "example": "API Key for my application" }, "roles": { "description": "An array containing strings which include the role name the user should be assigned to.", "type": "array", "items": { "type": "string" }, "example": [ "app_admin" ] } } }, "ApiKeyRecord": { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } }, "AsnRecord": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "AuditRecord": { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, "BgpNeighborCommon": { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } }, "BgpNeighborConfig": { "description": "BGP Neighbor Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "required": [ "addressremote", "description", "asn" ] }, "BgpNeighborRecord": { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } }, "BlockRecord": { "description": "Block Record", "type": "object" }, "ContextCreationModelCommon": { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } }, "ContextCreationModelConfig": { "description": "Context Creation Model Create or Update Config", "type": "object", "required": [ "description", "expiration", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] }, "ContextCreationModelRecord": { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } }, "DetectionCategoryConfig": { "description": "Detection Category Create or Update Config", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" } } }, "DetectionCategoryRecord": { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } }, "DeviceConfig": { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } }, "DnsRecord": { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, "DnsclassCommon": { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } }, "DnsclassConfig": { "description": "DNS Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "required": [ "domains" ] }, "DnsclassRecord": { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } }, "Error": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, "FlowRecord": { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } }, "FlowTagConfig": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } }, "Format": { "title": "format", "description": "Series data can be provided in a variety of formats which are native to some charting libraries. e.g. amcharts or highcharts", "type": "string", "default": "highcharts", "enum": [ "amcharts", "d3", "highcharts", "png" ], "example": "highcharts" }, "IntegrationsContext": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] }, "IntegrationsContextAws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "IntegrationsContextAzure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "IntegrationsContextCrowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "IntegrationsContextCrowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "IntegrationsContextGcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "IntegrationsContextIbm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "IntegrationsContextOracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "IntegrationsContextS3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "IntegrationsContextSentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "IntegrationsContextWiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } }, "IntegrationsResponse": { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] }, "IntegrationsResponseBgp": { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "IntegrationsResponseBlocklist": { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, "IntegrationsResponseCrowdstrike": { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, "IntegrationsResponseEmail": { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, "IntegrationsResponseFlowspec": { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "IntegrationsResponseFlowspecCustom": { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "IntegrationsResponseNs1": { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, "IntegrationsResponsePagerduty": { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, "IntegrationsResponseRoute53": { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, "IntegrationsResponseRtbh": { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, "IntegrationsResponseSlack": { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, "IntegrationsResponseSyslog": { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, "IntegrationsResponseTeams": { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, "IntegrationsResponseTwilio": { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, "IntegrationsResponseWebhook": { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } }, "IpRecord": { "type": "object", "additionalProperties": false, "properties": { "bogon": { "description": "Is a bogon or not", "type": "boolean", "example": false }, "ip": { "description": "IP Address", "type": "string", "example": "1.0.0.32" }, "firstseen": { "description": "Timestamp of first time this ip address was seen.", "type": "integer", "example": 1617980476 }, "lastseen": { "description": "Timestamp of last time this ip address was seen.", "type": "integer", "example": 1617991633 }, "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "iprep": { "description": "Object with ip reputation information", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "categories": { "type": "array", "description": "Array of geo reputation categories this ip address has been flagged in.", "maxItems": 1000, "items": { "type": "string", "example": "ddos" } } } }, "geo": { "description": "Object with geographic location information", "type": "object" }, "as": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "rdns": { "description": "Reverse DNS", "type": "string", "example": false }, "pdns": { "description": "Protective DNS", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "records": { "type": "array", "description": "Array of PDNS records", "maxItems": 1000, "items": { "type": "string" } } } } } }, "LabelIp": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } }, "LabelIpDelete": { "description": "Delete IP Labels via ip or context or both. One of ip or context is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address.", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. Default context is 'name'. Optional if ip is provided.", "type": "string", "example": "name" } } }, "LabelPortConfig": { "description": "Port Label Create Config", "type": "object", "required": [ "protocol", "port", "labels" ], "additionalProperties": false, "properties": { "protocol": { "description": "Protocol.", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } }, "LabelPortDelete": { "description": "Delete Port Labels via port or protocol or both. One of port or protocol is required. Both may be provided as well.", "type": "object", "required": [ "ip", "context" ], "additionalProperties": false, "properties": { "port": { "description": "Port. Optional if protocol is provided.", "type": "number", "example": 1 }, "protocol": { "description": "Protocol. Optional is port is provided.", "type": "string", "example": "udp" } } }, "LabelPortRecord": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } }, "Meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "NetclassCommon": { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } }, "NetclassConfig": { "description": "Network Classification Create or Update Config", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "required": [ "networks", "privatenets" ] }, "NetclassRecord": { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } }, "PermissionRecord": { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } }, "ResponsePolicyCommon": { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } }, "ResponsePolicyConfig": { "description": "Response Policy Create or Update Config", "type": "object", "required": [ "name" ], "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "plugins": { "type": "array", "items": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "214365f7-ac9a-45bc-9795-95958bdfa694" } } } }, "ResponsePolicyRecord": { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } }, "RoleConfig": { "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the role.", "type": "string", "example": "my_role" }, "description": { "description": "A user friendly description of the role.", "type": "string", "example": "Role for Testing" }, "canMasquerade": { "description": "(resellers only) Whether or not the role can masquerade into sub accounts.", "type": "boolean", "example": true, "default": false }, "canSendFlow": { "description": "Whether or not the role can send NetoFlow.", "type": "boolean", "example": true, "default": false }, "permissions": { "type": "array", "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] }, "example": [ { "resource": "account", "fetch": true, "create": true, "update": true, "delete": true }, { "resource": "customer", "fetch": true, "create": false, "update": false, "delete": false } ] } } }, "SearchConfig": { "type": "object", "required": [ "start", "end" ], "description": "Search configuration schema for querying data. This schema defines the parameters used to filter and retrieve records from a dataset.", "additionalProperties": false, "properties": { "start": { "description": "When the search should begin. Timestamp or negative number of seconds to look back.", "type": "integer", "example": -7200 }, "end": { "description": "When the search should end. Timestamp, 0 for now or negative number of seconds to look back.", "type": "integer", "example": 0 }, "size": { "description": "Number of results to return. To avoid timeouts on large datasets, we recommend setting this value.", "type": "integer", "example": 100 }, "from": { "description": "Used in pagination. Combination of from + size", "type": "integer" }, "include": { "description": "Array of fields you want returned as part of the records. Default is ALL fields.", "type": "array", "items": { "type": "string" }, "maxItems": 100 }, "search": { "description": "A NQL search filter for constraining the dataset.", "type": "string", "example": "bits > 1000" } } }, "ThresholdAutomatonConfig": { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } }, "ThresholdAutomatonPatchConfig": { "description": "Threshold Automaton Record", "type": "object", "anyOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ] }, "ThresholdAutomatonRecord": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } }, "ThresholdOverrideConfig": { "description": "Threshold Override Create or Update Config", "type": "object", "required": [ "algorithm", "rollupperiod", "thresholds", "track", "updateinterval" ], "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] }, "ThresholdOverrideRecord": { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } }, "ThresholdTrackValue": { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "average": { "type": "number", "description": "average value for operation", "example": 5176 }, "deviation": { "type": "number", "example": 2741552.2677988047 }, "operation": { "type": "string", "example": "AVERAGE(bits)" }, "threshold": { "type": "array", "description": "array holding values for each configured severity level for the data point.", "items": { "type": "object", "properties": { "level": { "type": "string", "example": "low" }, "value": { "type": "number", "example": 3028123.4945786856 } } } }, "customer": { "type": "string", "description": "Netography customer shortname", "example": "xpertdns" }, "group": { "type": "string", "description": "the specific track (group) the data corresponds to.", "example": "10.99.4.13" }, "algorithm": { "type": "string", "description": "the detection model the threshold values are derived from", "example": "1ms0rryminer_detection" }, "timestamp": { "type": "number", "description": "unix timestamp describing when the threshold values were generated", "example": 1725449961304 } } }, "TimeseriesSeries": { "type": "object", "description": "Configuration for a time series data query that defines how to aggregate and analyze network traffic data over time. Each series specifies the metric to measure, fields to group by, time intervals, and filtering criteria to generate meaningful analytics insights.", "required": [ "name", "metric", "size", "field" ], "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Series name. All series in a query must have a unique name. This is how you will locate them in the response.", "example": "my-series-name" }, "field": { "type": "array", "items": { "type": "string" }, "description": "Field name(s) to aggregate (split) on. See Analytics > Fields for more information.", "example": [ "dstip", "dstport" ], "maxItems": 7 }, "field_separator": { "type": "string", "default": ".", "description": "when multiple fields are provided in the request, the separator is used to join the two fields in the `label` and `name` keys in the response", "example": "||" }, "interval": { "type": "integer", "description": "Time interval to group the data. If not provided the interval will be calculated based on start/end times. The greater the window the larger the interval.", "example": 5 }, "ipagg": { "type": "object", "required": [ "cidr", "field" ], "additionalProperties": false, "properties": { "cidr": { "type": "integer", "description": "CIDR to aggregate on. 8, 16, 32", "example": 8 }, "field": { "type": "string", "description": "Field to aggregate the CIDR on. For flow and block valid fields are `srcip` and `dstip`. For alert the valid field is `ipinfo.ip`" } } }, "metric": { "type": "string", "description": "metric to aggregate on. See Metrics for available values.", "example": "flowrate" }, "search": { "type": "array", "maxItems": 1, "description": "A NQL search filter for constraining the dataset.", "items": { "type": "string" }, "example": [ "dstip == 192.168.0.0/16" ] }, "size": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "The \"Top N\" number of series to limit this query to. Not required for cardinality.", "format": "int32", "example": 10 }, "sort": { "type": "string", "description": "Buckets returned ascending (asc) or descending (desc).", "default": "asc" } } }, "TrafficDetectionModelCommon": { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } }, "TrafficDetectionModelConfig": { "description": "Traffic Detection Model Create or Update Config", "type": "object", "required": [ "categories", "description", "name", "rollupperiod", "search_by", "thresholds", "track_by", "algo_record_type" ], "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ] }, "TrafficDetectionModelRecord": { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } }, "UserConfig": { "required": [ "given_name", "family_name", "email", "roles" ], "additionalProperties": false, "properties": { "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "admin" ] } } }, "VpcConfigAwsKinesis": { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "VpcConfigAwsS3": { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, "VpcConfigAzureBlobstorage": { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "VpcConfigAzureVnetBlobstorage": { "description": "Azure VNet Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networkwatcher", "resourcegroup", "subscriptionid", "flowlog" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure-vnet" ], "example": "azure-vnet" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of this flow source in Netography Fusion. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "Enable or disable polling the cloud provider for samples", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "Virtual Network Region in Azure region format (lowercase with no spaces). Examples: eastus, centralus, westus2. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account Name where flow logs are stored", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name. Use default of insights-logs-flowlogflowevent. Do not include leading spaces in the value.\n", "example": "insights-logs-flowlogflowevent" }, "networkwatcher": { "type": "string", "description": "Azure Network Watcher's Name. Usually in format NetworkWatcher_region (e.g. NetworkWatcher_eastus).\n", "example": "NetworkWatcher_eastus" }, "resourcegroup": { "type": "string", "description": "Azure Network Watcher's Resource Group. Use default of NETWORKWATCHERRG. Do not change unless you know what you're doing.\n", "example": "NETWORKWATCHERRG" }, "flowlog": { "type": "string", "description": "Flow Log Name as shown in Network Watcher in Azure. This is a required field that identifies the specific flow log to collect.\n", "example": "flowlog-eastus-prod" }, "subscriptionid": { "type": "string", "description": "Network Watcher Subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "VpcConfigGcp": { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "VpcConfigIbmObjectstorage": { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "VpcConfigOracleObjectstorage": { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, "DNSDeviceRecord": { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } }, "responses": { "default_error": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } }, "bearer": { "description": "A JSON object which contains the `access_token` to use in all subsequent calls to the API", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "access_token": { "type": "string", "description": "Access Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "expires_in": { "type": "integer", "description": "Seconds until the Access Token expires", "readOnly": true, "example": 86400 }, "refresh_expires_in": { "type": "integer", "description": "Seconds until the Refresh Token expires", "readOnly": true, "example": 86400 }, "refresh_token": { "type": "string", "description": "Refresh Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "token_type": { "type": "string", "description": "Type of JWT token. Will always be \"bearer\"", "readOnly": true, "example": "bearer" }, "id_token": { "type": "string", "description": "ID Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "not-before-policy": { "type": "integer", "description": "Seconds until the Token will be considered valid. Will always be 0 (now).", "readOnly": true, "example": 0 }, "session-state": { "type": "string", "description": "Unique Session ID", "readOnly": true, "example": "9b4b13d7-c7a6-4f68-a419-cf1bf5aef94f" }, "scope": { "type": "string", "description": "Application Scopes", "readOnly": true, "example": "openid email app_metadata user_metadata profile" } } } } } }, "search_record": { "description": "An object which contains response metadata information and a data array of records", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "oneOf": [ { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, { "description": "Block Record", "type": "object" }, { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } } ] } } } } } } }, "bad_request_error": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "unauthorized_error": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "forbidden_error": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "fields": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "timeseries": { "description": "An object which contains response metadata information and a data object containing the Time Series array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "date": { "type": "integer", "description": "Unix Timestamp in milliseconds.", "example": 1617902100000 }, "field1": { "description": "data point value", "example": 10669651 } } }, { "type": "array", "description": "d3 series format", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "array", "description": "highcharts series format [ unix timestamp (ms), value ]", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "aggregation": { "description": "An object which contains response metadata information and a data object containing the Aggregation array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "interval": { "type": "string", "description": "aggregation time window. e.g. 1s, 1m, 1h, 1d, 1M", "example": "10m" }, "label": { "type": "string", "description": "value of the field in the requested series", "example": "srcip" }, "metric": { "type": "string", "description": "metric describing the data being returned.", "example": "flows" }, "name": { "type": "string", "description": "name of the series, corresponding to the fields provided in the request", "example": "srcip" }, "series": { "type": "string", "description": "name of the series, corresponding to the series name provided in the request", "example": "flow-agg-test" }, "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "category": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "d3 series format", "additionalProperties": false, "properties": { "field1": { "description": "field1 is the value of the field property in the request and it's value is the data point value", "example": 10669651 } } }, { "type": "object", "description": "highcharts series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "y": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "asn_lookup": { "description": "ASN Number and Organisation the ASN provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } } } } } } } }, "ip_lookup": { "description": "Ip Intelligence information for the ip addresses provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "bogon": { "description": "Is a bogon or not", "type": "boolean", "example": false }, "ip": { "description": "IP Address", "type": "string", "example": "1.0.0.32" }, "firstseen": { "description": "Timestamp of first time this ip address was seen.", "type": "integer", "example": 1617980476 }, "lastseen": { "description": "Timestamp of last time this ip address was seen.", "type": "integer", "example": 1617991633 }, "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "iprep": { "description": "Object with ip reputation information", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "categories": { "type": "array", "description": "Array of geo reputation categories this ip address has been flagged in.", "maxItems": 1000, "items": { "type": "string", "example": "ddos" } } } }, "geo": { "description": "Object with geographic location information", "type": "object" }, "as": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "rdns": { "description": "Reverse DNS", "type": "string", "example": false }, "pdns": { "description": "Protective DNS", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "records": { "type": "array", "description": "Array of PDNS records", "maxItems": 1000, "items": { "type": "string" } } } } } } } } } } } }, "ip_labels": { "description": "List of IP Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "ip_label": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "ip_labels_bulk": { "description": "Result of IP Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "port_labels": { "description": "List of Port Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "port_label": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "port_labels_protocols": { "description": "List of Port Labels Protocols Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Protocol name", "example": "tcp" } } } } } } } } }, "port_labels_bulk": { "description": "Result of Port Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "devices": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "device_statuses": { "description": "List of Device States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 114300552 }, "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.site.company.com" }, "flow": { "required": [ "lastseen", "active" ], "additionalProperties": false, "properties": { "lastseen": { "description": "Unix timestamp of last seen flow.", "type": "number", "example": 1558367737 }, "active": { "description": "Actively receiving flow.", "type": "boolean", "example": true } }, "type": "object" }, "bgp": { "type": "object", "additionalProperties": false, "properties": { "active": { "description": "BGP is active", "type": "boolean", "example": false } } } } } } } } } } }, "vpcs": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "vpc": { "description": "Object of a VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } }, "vpc_statuses": { "description": "List of VPC States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the vpc. This is immutable.", "example": 892079680 }, "name": { "description": "The name of the VPC.", "type": "string", "example": "prod-vpc-east" }, "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure", "aws" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events", "type": "string", "enum": [ "s3", "kinesis", "blobstorage", "pubsub", "objectstorage" ], "example": "blobstorage" }, "enabled": { "description": "If vpc flow collection is activated", "type": "boolean", "example": true }, "time": { "description": "Time stamp of last attempted poll", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "success": { "description": "true if last poll was successful", "type": "boolean", "example": true, "readOnly": true }, "attempt": { "description": "Count of job restarts since last reset.", "type": "integer", "example": 0, "readOnly": true }, "created": { "description": "The time at which config was created.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "lastupdated": { "description": "The last time config was changed.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "error": { "description": "Array of error messages (if known)", "type": "array", "items": { "type": "string" }, "example": [ "Invalid credentials" ], "readOnly": true }, "progress": { "type": "array", "description": "Array of output from checkpoints or steps to complete the capture of flow.", "items": { "type": "object", "properties": { "step": { "type": "string", "readOnly": true, "description": "A check point step.", "example": "COS Session Created" }, "description": { "type": "string", "readOnly": true, "description": "Details about this step.", "example": "Create client session connection to cloud object storage." }, "error": { "type": "string", "readOnly": true, "description": "Error encountered during this step." }, "status": { "type": "string", "readOnly": true, "description": "Status of this step.", "example": "pass" } } }, "readOnly": true } } } } } } } } }, "regions": { "description": "An object which contains response metadata information and a data object containing the region array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of region.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "id of the region", "readOnly": true, "example": "aws_ap-east-1" }, "description": { "type": "string", "description": "description of the", "readOnly": true, "example": "Asia Pacific (Hong Kong)" }, "label": { "type": "string", "readOnly": true, "description": "label of the region.", "example": "ap-east-1" }, "provider": { "type": "string", "readOnly": true, "description": "provider of the region", "example": "aws" }, "region": { "type": "string", "readOnly": true, "description": "region the service is located in.", "example": "us-east-1" } } } } } } } } }, "integrations_contexts": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } } }, "integrations_context": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } }, "integrations_responses": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "tags": { "description": "An array of Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "required": [ "entitytype", "entityname", "entityid", "tag" ], "additionalProperties": false, "properties": { "entitytype": { "type": "string", "description": "entity this tag is associated with", "enum": [ "device", "flow", "vpc" ], "example": "flow" }, "entityname": { "type": "string", "description": "name of the entity", "example": "Flow Rule 1" }, "entityid": { "type": "string", "readOnly": true, "description": "id of the entity", "example": 325067628 }, "tag": { "type": "string", "description": "value of the tag", "example": "mytag" } } } } } } } } }, "ip_tags": { "description": "Tag values for an IP address within a timeframe", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "type": "string", "description": "tag value", "example": "web-traffic" } } } } } } }, "flow_tag": { "description": "An array of Flow Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } } } } }, "permission_response": { "description": "Object of available role permissions", "content": { "application/json": { "schema": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } }, "role": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "user": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "api_keys": { "description": "List of Requested API Keys", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } } }, "api_key_with_secret": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "appkey": { "type": "string", "readOnly": true, "description": "The API Key", "example": "fMBQnzyGRnHuTEjhOclqZwHTPh7dBP1MkZtV" } } }, { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "api_key_without_secret": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "accounts_response": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } } }, "account_response": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } }, "access_allowed_ips": { "description": "Access Allowed IP List from KeyCloak", "content": { "application/json": { "schema": { "type": "array", "items": { "type": "string" }, "example": [ "1.1.1.1", "2.2.2.2", "3.3.3.3/16" ] } } } }, "traffic_detection_models": { "description": "List of Requested Traffic Detection Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "traffic_detection_model": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "context_creation_models": { "description": "List of Requested Context Creation Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "context_creation_model": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "detection_categories": { "description": "List of Requested Detection Categories", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } } }, "detection_category": { "description": "Requested Detection Category", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } }, "response_policies": { "description": "List of Requested Response Policies", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "response_policy": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "threshold_overrides": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "bgp_neighbors": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "bgp_neighbor": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "netclasses": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } } }, "netclass": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } }, "dnsclasses": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } } }, "dnsclass": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } }, "threshold_automaton_configs": { "description": "List of threshold automaton configs for a customer", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } ] } } } } } } }, "threshold_automaton_config": { "description": "Threshold Automaton config", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } } } } } }, "threshold_track_data": { "description": "List of track values for a given auto threshold", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "average": { "type": "number", "description": "average value for operation", "example": 5176 }, "deviation": { "type": "number", "example": 2741552.2677988047 }, "operation": { "type": "string", "example": "AVERAGE(bits)" }, "threshold": { "type": "array", "description": "array holding values for each configured severity level for the data point.", "items": { "type": "object", "properties": { "level": { "type": "string", "example": "low" }, "value": { "type": "number", "example": 3028123.4945786856 } } } }, "customer": { "type": "string", "description": "Netography customer shortname", "example": "xpertdns" }, "group": { "type": "string", "description": "the specific track (group) the data corresponds to.", "example": "10.99.4.13" }, "algorithm": { "type": "string", "description": "the detection model the threshold values are derived from", "example": "1ms0rryminer_detection" }, "timestamp": { "type": "number", "description": "unix timestamp describing when the threshold values were generated", "example": 1725449961304 } } } ] } } } } } } }, "mitre_tactics": { "description": "List of MITRE Tactics with Techniques", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "description": "MITRE ATT&CK Tactic Record", "type": "object", "properties": { "tactic_name": { "type": "string", "example": "Reconnaissance" }, "tactic_id": { "type": "string", "example": "TA0043" }, "techniques": { "type": "array", "items": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } } } } } } } } } } }, "mitre_techniques": { "description": "Techniques for a Specific MITRE Tactic", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "description": "MITRE ATT&CK Technique Record", "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595" }, "technique_name": { "type": "string", "example": "Active Scanning" }, "sub_techniques": { "type": "array", "items": { "type": "object", "properties": { "technique_id": { "type": "string", "example": "t1595.001" }, "technique_name": { "type": "string", "example": "Scanning IP Blocks" } } } } } } } } } } } }, "dns_devices": { "description": "List of Requested DNS Devices", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } } }, "dns_device": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "not_found_error": { "description": "Not Found", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 404 }, "name": { "example": "NotFoundError" }, "message": { "example": "Requested Item Not Found" } } } ] } } } }, "AccountResponse": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } }, "AccountsResponse": { "description": "Account response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "description": "Account properties", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "Internal ID. Immutable" }, "billing": { "type": "object", "description": "Configuration Information", "additionalProperties": false, "properties": { "data_retention": { "type": "integer", "description": "Data Retention (days)" }, "rollup_retention": { "type": "integer", "description": "Data Rollup Retention (days)" }, "trial": { "type": "boolean", "description": "True if considered a trial account" } } }, "ingest_ip": { "type": "string", "description": "Flow ingest ip address assigned to the customer" }, "ingest_port": { "type": "integer", "description": "Flow ingest ip port assigned to the customer" }, "reseller": { "type": "object", "description": "Reseller Configuration", "additionalProperties": false, "properties": { "children": { "type": "integer", "description": "Number of direct sub accounts" }, "is_parent": { "type": "boolean", "description": "True if sub accounts exist" }, "node": { "type": "string", "description": "Tree-based shortname for reseller heirarchy" }, "parent": { "type": "string", "description": "Shortname of the parent reseller" } } }, "shortname": { "type": "string", "description": "Account shortname" } } } ] } } } } } } }, "Aggregation": { "description": "An object which contains response metadata information and a data object containing the Aggregation array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "interval": { "type": "string", "description": "aggregation time window. e.g. 1s, 1m, 1h, 1d, 1M", "example": "10m" }, "label": { "type": "string", "description": "value of the field in the requested series", "example": "srcip" }, "metric": { "type": "string", "description": "metric describing the data being returned.", "example": "flows" }, "name": { "type": "string", "description": "name of the series, corresponding to the fields provided in the request", "example": "srcip" }, "series": { "type": "string", "description": "name of the series, corresponding to the series name provided in the request", "example": "flow-agg-test" }, "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "category": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "d3 series format", "additionalProperties": false, "properties": { "field1": { "description": "field1 is the value of the field property in the request and it's value is the data point value", "example": 10669651 } } }, { "type": "object", "description": "highcharts series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "y": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "ApiKeyWithSecret": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "appkey": { "type": "string", "readOnly": true, "description": "The API Key", "example": "fMBQnzyGRnHuTEjhOclqZwHTPh7dBP1MkZtV" } } }, { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "ApiKeyWithoutSecret": { "description": "Object of a Requested API Key", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } }, "ApiKeys": { "description": "List of Requested API Keys", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "API Key Record", "type": "object", "properties": { "appname": { "type": "string", "readOnly": true, "description": "API Key Name", "example": "my_application" }, "description": { "type": "string", "description": "API Key Description", "example": "API Key for my application" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] }, "last_login": { "type": "number", "readOnly": true, "description": "Unix timestamp of last login", "example": 1691164160466 }, "last_ip": { "type": "string", "readOnly": true, "description": "Last IP address used to login", "example": "127.0.0.1" } } } ] } } } } } } }, "AsnLookup": { "description": "ASN Number and Organisation the ASN provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } } } } } } } }, "BadRequestError": { "description": "Bad Request. Typically due to a malformatted JSON body, or parameter values are not validating.", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 400 }, "name": { "example": "BadRequestError" }, "message": { "example": "Bad Request" } } } ] } } } }, "Bearer": { "description": "A JSON object which contains the `access_token` to use in all subsequent calls to the API", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "access_token": { "type": "string", "description": "Access Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "expires_in": { "type": "integer", "description": "Seconds until the Access Token expires", "readOnly": true, "example": 86400 }, "refresh_expires_in": { "type": "integer", "description": "Seconds until the Refresh Token expires", "readOnly": true, "example": 86400 }, "refresh_token": { "type": "string", "description": "Refresh Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "token_type": { "type": "string", "description": "Type of JWT token. Will always be \"bearer\"", "readOnly": true, "example": "bearer" }, "id_token": { "type": "string", "description": "ID Token (JWT)", "readOnly": true, "example": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI....KpQXk3fiwnSbREHlvfdi7weWuM" }, "not-before-policy": { "type": "integer", "description": "Seconds until the Token will be considered valid. Will always be 0 (now).", "readOnly": true, "example": 0 }, "session-state": { "type": "string", "description": "Unique Session ID", "readOnly": true, "example": "9b4b13d7-c7a6-4f68-a419-cf1bf5aef94f" }, "scope": { "type": "string", "description": "Application Scopes", "readOnly": true, "example": "openid email app_metadata user_metadata profile" } } } } } }, "BgpNeighbor": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "BgpNeighbors": { "description": "List of BGP Neighbors", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "BGP Neighbor Record", "type": "object", "allOf": [ { "type": "object", "properties": { "addresslocal": { "type": "string" }, "addressremote": { "type": "string" }, "admindown": { "type": "boolean" }, "advanced": { "type": "boolean" }, "asn": { "type": "string" }, "authpassword": { "type": "string" }, "description": { "type": "string" }, "deviceid": { "type": "string" }, "gracefulrestart": { "type": "boolean" }, "holdtime": { "type": "integer" }, "ipv4-flowspec": { "type": "boolean" }, "ipv4-unicast": { "type": "boolean" }, "ipv6-flowspec": { "type": "boolean" }, "ipv6-unicast": { "type": "boolean" }, "keepalive": { "type": "integer" }, "negotiated": { "type": "object", "properties": { "capabilities": { "type": "array" }, "holdtime": { "type": "integer" }, "keepalive": { "type": "integer" } } }, "restarttime": { "type": "integer" }, "routes": { "type": "object", "properties": { "ipv4-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv4-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-flow": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "ipv6-unicast": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "received": { "type": "integer" } } }, "total": { "type": "object", "properties": { "accepted": { "type": "integer" }, "advertised": { "type": "integer" }, "prefixrate": { "type": "integer" }, "prefixsessioncount": { "type": "integer" }, "prefixtotalcount": { "type": "integer" }, "received": { "type": "integer" } } } } }, "state": { "type": "string" }, "stats": { "type": "object", "properties": { "recv": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } }, "sent": { "type": "object", "properties": { "discarded": { "type": "integer" }, "keepalives": { "type": "integer" }, "notifications": { "type": "integer" }, "opens": { "type": "integer" }, "routerefreshes": { "type": "integer" }, "updates": { "type": "integer" }, "withdrawprefix": { "type": "integer" }, "withdrawupdate": { "type": "integer" } } } } }, "uptime": { "type": "string" } } } ], "properties": { "id": { "type": "string" } } } ] } } } } } } }, "ContextCreationModel": { "description": "Requested Context Creation Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "ContextCreationModels": { "description": "List of Requested Context Creation Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Context Creation Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "action": { "description": "Action for the context model", "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "example": "label" }, "field": { "type": "string", "example": "dstip" }, "context": { "type": "string", "example": "func" }, "labels": { "type": "array", "items": { "type": "string" }, "example": [ "Testing" ] } } }, "example": [ { "type": "label", "field": "dstip", "context": "func", "labels": [ "Testing" ] } ] }, "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the context model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Context model description", "type": "string", "example": "context model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the context model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the context model is enabled", "type": "boolean", "example": true }, "expiration": { "description": "Number of seconds the context creation model will remain active", "type": "integer", "example": 3600 }, "factors": { "description": "Factors for the context model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the context model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the context model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the context model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the context model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the context model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the context model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Context model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta context model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Context model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended context model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the context model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the context model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system context model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default context model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "DefaultError": { "description": "Unknown Error Occurred", "content": { "application/json": { "schema": { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } } } } }, "DetectionCategories": { "description": "List of Requested Detection Categories", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } } }, "DetectionCategory": { "description": "Requested Detection Category", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Detection Category Record", "type": "object", "properties": { "description": { "description": "Detection category description", "type": "string", "example": "T1041 Exfiltration Over C2 Channel" }, "name": { "description": "Detection category name", "type": "string", "example": "t1041" }, "system": { "description": "If true, it's a system detection category", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection category", "type": "boolean", "example": false } } } ] } } } } } }, "DeviceStatuses": { "description": "List of Device States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 114300552 }, "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.site.company.com" }, "flow": { "required": [ "lastseen", "active" ], "additionalProperties": false, "properties": { "lastseen": { "description": "Unix timestamp of last seen flow.", "type": "number", "example": 1558367737 }, "active": { "description": "Actively receiving flow.", "type": "boolean", "example": true } }, "type": "object" }, "bgp": { "type": "object", "additionalProperties": false, "properties": { "active": { "description": "BGP is active", "type": "boolean", "example": false } } } } } } } } } } }, "Devices": { "description": "List of Devices Requested, or an array containing the new/updated Device after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "required": [ "id", "name", "ips", "samplerate" ], "allOf": [ { "type": "object", "required": [ "id" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the device. This is immutable.", "example": 771387127 } } }, { "required": [ "name", "ips", "samplerate" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the device. Eg. router1.site.company.com", "type": "string", "example": "router1.example.com" }, "ips": { "description": "An array of IPs that this device sends flows from.", "type": "array", "items": { "type": "string", "format": "cidr" }, "example": [ "1.1.1.1", "22.33.44.55" ] }, "samplerate": { "description": "The samplerate of flows this device will send.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 10 }, "payload": { "description": "Whether to store payload sample or not. SFLOW only. Default to false if not set.", "type": "boolean", "example": false }, "tags": { "description": "An array of strings to tag every flow from this device with.", "type": "array", "items": { "type": "string" }, "example": [ "edge" ] }, "site": { "description": "The site identifier for this device.", "type": "string", "example": "us-east-1" } } } ] } } } } } } }, "Dnsclass": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } }, "Dnsclasses": { "description": "List of DNS Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "DNS Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "domains": { "type": "array", "items": { "type": "string" }, "description": "The list of internal domains" } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the dns classification." } } } ] } } } } } } }, "Fields": { "description": "An object which contains response metadata information and a data array of Fields.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of the Fields.", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "field": { "description": "Field name", "type": "string", "readOnly": true, "example": "srcas.org" }, "type": { "description": "value type. e.g. string, integer, float, Array of strings, boolean", "type": "string", "readOnly": true, "example": "string" }, "description": { "description": "Human readable description of the field", "type": "integer", "readOnly": true, "example": "Source AS Organization the traffic came from" } } } } } } } } }, "FlowTag": { "description": "An array of Flow Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "required": [ "name", "tags" ], "additionalProperties": false, "properties": { "name": { "description": "The name of the Flow Tag Rule. Eg. carrier tags", "type": "string" }, "tags": { "description": "An array of strings to tag every flow that matches this response policy (rule) with", "type": "array", "items": { "type": "string" } }, "inputaliasregex": { "description": "A regular expression that matches against inputalias of a given flow record.", "type": "string" }, "inputnameregex": { "description": "A regular expression that matches against inputname of the input interface of a given flow record.", "type": "string" }, "outputaliasregex": { "description": "A regular expression that matches against outputalias of a given flow record.", "type": "string" }, "outputnameregex": { "description": "A regular expression that matches against outputname of a given flow record.", "type": "string" }, "srcnets": { "description": "An array of CIDR blocks to match against the source IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "dstnets": { "description": "An array of CIDR blocks to match against the destination IP for a given flow record.", "type": "array", "items": { "type": "string" } }, "srcport": { "description": "Source port to match against a given flow.", "type": "integer", "format": "int32" }, "dstport": { "description": "Destination port to match against a given flow.", "type": "integer", "format": "int32" }, "protocol": { "description": "lower case string representing the protocol of this flow. Eg. tcp, udp, icmp etc", "type": "string" }, "tcpflagsint": { "description": "integer representing which tcp flags were set in the flow record. Values between 0-255 are valid.", "type": "integer", "format": "int32" }, "srcas": { "description": "An array of AS numbers to match against the source AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstas": { "description": "An array of AS numbers to match against the destination AS for a given flow record.", "type": "array", "items": { "type": "integer" } }, "srcowneras": { "description": "An array of AS numbers to match against the AS of the source IP for a given flow record.", "type": "array", "items": { "type": "integer" } }, "dstowneras": { "description": "An array of AS numbers to match against the AS of the destination IP for a given flow record.", "type": "array", "items": { "type": "integer" } } }, "example": { "id": "325068886", "name": "customer-web-traffic", "tags": [ "customer", "web" ], "dstnets": [ "10.0.0.0/24", "192.168.0.0/16" ], "dstport": 80, "protocol": "tcp" } } } } } } } }, "ForbiddenError": { "description": "Access is forbidden", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 403 }, "name": { "example": "ForbiddenError" }, "message": { "example": "Forbidden" } } } ] }, "examples": { "Default": { "value": { "status": 403, "name": "ForbiddenError", "message": "Forbidden | Reason" } }, "IpIsNotAllowed": { "value": { "status": 403, "name": "ForbiddenError", "message": "Your IP address is outside of access-allowed IPs range" } } } } } }, "IntegrationsContext": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } }, "IntegrationsContexts": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The id of the context integration. This is immutable." }, "created": { "type": "string", "description": "Date/time the context integration was created." }, "lastupdated": { "type": "string", "description": "Date/time the context integration was last updated." }, "allOf": { "description": "List of Context Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "name", "type", "enabled", "updateinterval" ], "allOf": [ { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the context integration" }, "type": { "type": "string", "description": "The type of the context integration. The configuration parameters are dependent on this value.", "enum": [ "aws", "azure", "crowdstrike", "crowdstrikediscover", "ibm", "oracle", "gcp", "s3" ] }, "enabled": { "type": "boolean", "description": "The state of the context integration. Whether to auto update or not." }, "updateinterval": { "type": "integer", "description": "The number of seconds by which to poll the integration.", "minimum": 3600, "maximum": 604800, "format": "int32", "example": 86400 }, "aws": { "type": "object", "description": "Configuration options specific to type aws. nil if not configuring AWS", "required": [ "awsauthtype", "region" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in AWS", "example": [ "tag1", "tag2" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "azure": { "type": "object", "description": "Configuration options specific to type azure. nil if not configuring Azure", "required": [ "clientid", "clientsecret", "subscriptionid", "tenantid" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to use authenticating with azure", "type": "string" }, "clientsecret": { "description": "The client secret to use authenticating with azure", "type": "string" }, "subscriptionid": { "type": "string", "description": "The azure subscription id to be queried" }, "tenantid": { "type": "string", "description": "The azure tenant id to use" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in Azure", "example": [ "tag1", "tag2" ] } } }, "crowdstrike": { "type": "object", "description": "Configuration options specific to crowdstrike. nil if not configuring CrowdStrike Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "crowdstrikediscover": { "type": "object", "description": "Configuration options specific to crowdstrikediscover. nil if not configuring CrowdStrike Discover Falcon.", "required": [ "clientid", "clientsecret", "cloud" ], "additionalProperties": false, "properties": { "clientid": { "description": "The client id to authenticate to the Falcon cloud api", "type": "string" }, "clientsecret": { "description": "The client secret to authenticate to the Falcon cloud api", "type": "string" }, "cloud": { "type": "string", "description": "The Falcon cloud abbreviation to query", "enum": [ "us-1", "us-2", "eu-1", "us-gov-1" ] }, "filter": { "type": "string", "description": "An optional FQL string to be used when filtering results, e.g. entity_type:'managed'+last_seen_timestamp:<'now-3d" }, "sort": { "type": "string", "description": "An optional FQL sort string, e.g. last_seen_timestamp.desc" } } }, "ibm": { "type": "object", "description": "Configuration options specific to ibm. nil if not configuring IBM Cloud", "required": [ "apikey", "region" ], "properties": { "apikey": { "description": "The api key to use for authentication", "type": "string" }, "region": { "type": "string", "description": "The IBM region to query" } } }, "oracle": { "type": "object", "description": "Configuration options specific to oracle. nil if not configuring Oracle Cloud", "required": [ "user", "tenancy", "region" ], "additionalProperties": false, "properties": { "user": { "description": "The user ocid to use for authentication to oracle cloud", "type": "string" }, "tenancy": { "description": "The tenancy ocid to use for connecting to oracle cloud", "type": "string" }, "region": { "type": "string", "description": "The region of oracle cloud to connect to" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom tag names to track in oracle cloud", "example": [ "tag1", "tag2" ] } } }, "gcp": { "type": "object", "description": "Configuration options specific to gcp. nil if not configuring GCP", "required": [ "zone", "credentials" ], "additionalProperties": false, "properties": { "zone": { "description": "The GCP zone for this configuration", "type": "string" }, "credentials": { "type": "object", "description": "The credentials object necessary to authenticate to the project. This is sent to you via a json file download following the creation of a GCP service account.", "additionalProperties": false, "required": [ "type", "project_id", "private_key_id", "private_key", "client_email", "client_id", "auth_uri", "token_uri", "auth_provider_x509_cert_url", "client_x509_cert_url" ], "properties": { "type": { "type": "string", "description": "Credential type. this will typically be \"service_account\"", "example": "service_account" }, "project_id": { "type": "string", "description": "The project id of the account" }, "private_key_id": { "type": "string", "description": "The private key id of the service account" }, "private_key": { "type": "string", "description": "The pirvate key to authenticate with" }, "client_email": { "type": "string", "description": "The email of the service account" }, "client_id": { "type": "string", "description": "The id of the client" }, "auth_uri": { "type": "string", "description": "OAth2 uri" }, "token_uri": { "type": "string", "description": "Token URI" }, "auth_provider_x509_cert_url": { "type": "string", "description": "Auth cert url" }, "client_x509_cert_url": { "type": "string", "description": "Client cert url" } } }, "labels": { "type": "array", "items": { "type": "string" }, "description": "An array of strings to match any custom label names to track in GCP", "example": [ "label1", "label2" ] } } }, "s3": { "type": "object", "description": "Configuration options specific to type s3.\n This is used for pulling a CSV file from an S3 bucket. The format of the file is ip,context,label1,label2 etc. nil if not configuring S3\n", "required": [ "awsauthtype", "region", "bucket" ], "additionalProperties": false, "properties": { "region": { "type": "string", "description": "The aws region to authenticate to", "example": "us-east-1" }, "bucket": { "type": "string", "description": "The name of the s3 bucket from which to pull the csv file." }, "path": { "type": "string", "description": "The path to the csv file to import labels from. The format of the file is ip,context,label1,label2,..." }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, "sentinelone": { "type": "object", "description": "Configuration options specific to sentinelone. nil if not configuring SentinelOne", "required": [ "base_url", "params", "token" ], "additionalProperties": false, "properties": { "base_url": { "description": "The SentinelOne domain URL to query, e.g. https://.sentinelone.net", "type": "string" }, "params": { "type": "object", "additionalProperties": false, "properties": { "accountId": { "type": "string", "description": "The SentinelOne account ID to query" }, "filterId": { "type": "string", "description": "The SentinelOne filter ID to limit query, SentinelOne API result size limit is 10,000" } } }, "token": { "description": "API token to use for authentication", "type": "string" }, "ranger": { "type": "object", "properties": { "enabled": { "type": "boolean", "example": true } } } } }, "wiz": { "type": "object", "description": "Configuration options specific to wiz. nil if not configuring Wiz", "required": [ "apiendpoint", "tokenurl", "clientid", "clientsecret" ], "additionalProperties": false, "properties": { "apiendpoint": { "description": "Wiz API Endpoint URL", "type": "string", "enum": [ "https://api.us1.app.wiz.io/graphql", "https://api.us2.app.wiz.io/graphql", "https://api.eu1.app.wiz.io/graphql", "https://api.eu2.app.wiz.io/graphql", "https://api.us17.app.wiz.io/graphql" ] }, "tokenurl": { "description": "Wiz Token URL", "type": "string", "enum": [ "https://auth.app.wiz.io/oauth/token", "https://auth.wiz.io/oauth/token", "https://auth.gov.wiz.io/oauth/token", "https://auth0.gov.wiz.io/oauth/token" ] }, "clientid": { "description": "Client id to use authenticating with Wiz API", "type": "string" }, "clientsecret": { "description": "Client secret to use authenticating with Wiz API", "type": "string" } } } } } ] } } } } } } } } }, "IntegrationsResponses": { "description": "List of Response Integrations Requested, or an array containing the new/updated Response Integration after a Create or Update operation.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "List of Response Integrations Requested, or an array containing the new/updated Context Integration after a Create or Update operation.", "type": "object", "required": [ "adapter", "name", "description" ], "allOf": [ { "type": "object", "additionalProperties": false, "properties": { "adapter": { "type": "string", "description": "The type of response integration. The config object is dependant on this.", "enum": [ "bgp", "blocklist", "crowdstrike", "email", "flowspec", "flowspec_custom", "ns1", "pagerduty", "route53", "rtbh", "slack", "syslog", "teams", "twilio", "webhook" ] }, "name": { "type": "string", "description": "The name of the response integration" }, "description": { "type": "string", "description": "The description of the response integration." }, "config": { "oneOf": [ { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "factors", "expiration", "max" ], "additionalProperties": false, "properties": { "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "max": { "type": "integer", "example": 0 }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "url", "client_id", "client_secret" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "url": { "description": "Crowdstrike base API URL, can be found in your crowdstrike account", "type": "string", "example": "https://api.us-2.crowdstrike.com" }, "client_id": { "type": "string", "example": "7e4629d1de4342f99420d2d80863c43e" }, "client_secret": { "type": "string", "example": "5m9LUCaSlk480NRTkZucvjHx2f1fe6OlYa7PV3Fy" } } }, { "type": "object", "required": [ "recipients", "cc", "bcc" ], "additionalProperties": false, "properties": { "recipients": { "type": "array", "items": { "type": "string" }, "example": [ "me@email.com" ] }, "cc": { "type": "array", "items": { "type": "string" }, "example": [ "you@email.com" ] }, "bcc": { "type": "array", "items": { "type": "string" }, "example": [] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "expiration", "factors", "max", "neighbors", "rule" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "rule": { "type": "string", "example": "match source SRCIP then discard" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "apikey", "domain", "link", "type", "zone" ], "additionalProperties": false, "properties": { "apikey": { "description": "API Key", "type": "string", "example": "v5WK5FE8evL5yS9YDE43" }, "domain": { "type": "string", "example": "example.mydomain.com" }, "link": { "type": "string", "example": "link.mydomain.com" }, "type": { "type": "string", "description": "Record type", "example": "A" }, "zone": { "type": "string", "example": "mydomain.com" } } }, { "type": "object", "required": [ "apikey", "integrationkey", "severity" ], "additionalProperties": false, "properties": { "apikey": { "type": "string", "example": "utsyNZTKbmV1yh9BSfbX" }, "integrationkey": { "type": "string", "example": "9bfafb1cdc56455dbdfc79d814c7e979" }, "severity": { "type": "string", "example": "info" } } }, { "type": "object", "required": [ "accesskeyid", "aliastarget", "evaluatetargethealth", "hostedzoneid", "name", "secretaccesskey", "type" ], "additionalProperties": false, "properties": { "accesskeyid": { "type": "string" }, "aliastarget": { "type": "object", "example": "alert-start.mydomain.com" }, "evaluatetargethealth": { "type": "boolean", "example": false }, "hostedzoneid": { "type": "string", "example": "ZAF53OCP1CQDR" }, "name": { "type": "string", "example": "alert.mydomain.com" }, "secretaccesskey": { "type": "string", "example": "Z5tKQdsCtUivua5WFwbZwyal6F71I" }, "type": { "type": "string", "description": "Record type", "example": "A" } } }, { "type": "object", "required": [ "expiration", "community", "factors", "max", "neighbors", "nexthop" ], "additionalProperties": false, "properties": { "expiration": { "description": "In seconds before expiration from the blocklist", "type": "integer", "example": 3600 }, "community": { "type": "string", "example": "65534:999" }, "factors": { "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "max": { "type": "integer", "example": 0 }, "neighbors": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225-96.91.123.226" ] }, "nexthop": { "type": "string", "example": "192.0.2.1" }, "whitelist": { "type": "array", "items": { "type": "string" }, "example": [ "96.91.123.225" ] } } }, { "type": "object", "required": [ "url", "channel" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX" }, "channel": { "type": "string", "example": "#alerts" } } }, { "type": "object", "required": [ "host", "facility", "protocol", "tag", "output" ], "additionalProperties": false, "properties": { "host": { "type": "string", "description": "combination of hostname and port (host:port) where host is typically ipv4 and port is required. 514 is a safe default port.", "example": "192.168.0.1:514" }, "facility": { "type": "string", "description": "LOG_LOCAL0 is a safe default", "enum": [ "LOG_KERN", "LOG_USER", "LOG_MAIL", "LOG_DAEMON", "LOG_AUTH", "LOG_SYSLOG", "LOG_LPR", "LOG_NEWS", "LOG_UUCP", "LOG_CRON", "LOG_AUTHPRIV", "LOG_FTP", "LOG_LOCAL0", "LOG_LOCAL1", "LOG_LOCAL2", "LOG_LOCAL3", "LOG_LOCAL4", "LOG_LOCAL5", "LOG_LOCAL6", "LOG_LOCAL7" ], "example": "LOG_LOCAL0" }, "protocol": { "type": "string", "description": "udp or tcp, udp is a safe default", "enum": [ "udp", "tcp" ], "example": "udp" }, "tag": { "type": "string", "description": "dot separated “application tag” that will be included in messages", "example": "neto.message" }, "output": { "type": "string", "description": "One of CEE (elastic, json payload), CEF (arcSite Comment Event Format) or default (just the summary)", "enum": [ "CEE", "CEF", "DEFAULT" ] } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "url": { "type": "string", "example": "https://teams.microsoft.com/l/channel/730db0bd74f31819947a24cc87f67%40thread.tacv2/Notifications%2520Test?groupId=-0a1e-4517-a107-f00465d9070b&tenantId=5d944d1a-9439-45f7-964c-171de4d40bf7" }, "short": { "type": "boolean", "description": "Display messages in a shorter style", "example": false } } }, { "type": "object", "required": [ "accountsid", "authtoken", "to", "messagingservicesid" ], "additionalProperties": false, "properties": { "accountsid": { "type": "string", "example": "AC03bc8692321c99089f5545a56f60e2d" }, "authtoken": { "type": "string", "example": "ab0a148afb34299c69282f5e62ac541" }, "to": { "type": "object", "additionalProperties": false, "properties": { "number": { "type": "string", "example": "650-353-9999" }, "region": { "type": "string", "example": "US" } } }, "messagingservicesid": { "type": "string", "example": "MG43f6daee98ff2269eb5cd11ca3b7d7f" } } }, { "type": "object", "required": [ "url" ], "additionalProperties": false, "properties": { "authpassword": { "type": "string", "description": "HTTP Basic Auth password" }, "authusername": { "type": "string", "description": "HTTP Basic Auth ID" }, "contenttype": { "type": "string", "example": "json" }, "headers": { "type": "object", "description": "Comma separated list of header:value pairs", "example": {} }, "skipsslverification": { "type": "boolean", "description": "Don’t check the server certificate against the available certificate authorities. Also don’t require the URL host name to match the common name presented by the certificate", "example": false }, "url": { "type": "string", "example": "https://mydomain.com/webhook" } } } ] } } } ] } ] } } } } } } }, "IpLabel": { "description": "IP Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } } } } } }, "IpLabels": { "description": "List of IP Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "IpLabelsBulk": { "description": "Result of IP Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "IP Label Create Config.", "type": "object", "required": [ "ip", "context", "labels" ], "additionalProperties": false, "properties": { "ip": { "description": "IP address", "type": "string", "example": "10.250.0.1" }, "context": { "description": "IP label context. default context is 'name'.", "type": "string", "example": "name" }, "labels": { "description": "Array containing the IP labels.", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "name1", "name2" ] } } } ] } } } } } } }, "IpLookup": { "description": "Ip Intelligence information for the ip addresses provided in the request.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "bogon": { "description": "Is a bogon or not", "type": "boolean", "example": false }, "ip": { "description": "IP Address", "type": "string", "example": "1.0.0.32" }, "firstseen": { "description": "Timestamp of first time this ip address was seen.", "type": "integer", "example": 1617980476 }, "lastseen": { "description": "Timestamp of last time this ip address was seen.", "type": "integer", "example": 1617991633 }, "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "iprep": { "description": "Object with ip reputation information", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "categories": { "type": "array", "description": "Array of geo reputation categories this ip address has been flagged in.", "maxItems": 1000, "items": { "type": "string", "example": "ddos" } } } }, "geo": { "description": "Object with geographic location information", "type": "object" }, "as": { "type": "object", "additionalProperties": false, "description": "ASN record schema for the AS number lookup API. This schema defines the structure of the response returned when querying for an Autonomous System Number (ASN) and its associated organization.", "properties": { "number": { "description": "AS number looked up", "type": "integer", "example": 15169 }, "org": { "description": "AS Org for this AS number", "type": "string", "example": "Google LLC" } } }, "rdns": { "description": "Reverse DNS", "type": "string", "example": false }, "pdns": { "description": "Protective DNS", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of times this ip address has been seen.", "type": "integer", "example": 32 }, "records": { "type": "array", "description": "Array of PDNS records", "maxItems": 1000, "items": { "type": "string" } } } } } } } } } } } }, "Netclass": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } }, "Netclasses": { "description": "List of Network Classifications", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Network Classification Record", "type": "object", "allOf": [ { "type": "object", "properties": { "networks": { "type": "array", "items": { "type": "string" }, "description": "The list of networks in the classification." }, "privatenets": { "type": "boolean", "description": "Whether the classification includes private networks." }, "privateasns": { "type": "boolean", "description": "Whether the classification includes private ASNs." }, "asns": { "type": "array", "items": { "type": "string" }, "description": "The list of ASNs in the classification." } } } ], "properties": { "id": { "type": "string", "description": "The unique identifier for the network classification." }, "type": { "type": "string", "description": "The type of network classification." } } } ] } } } } } } }, "NotFoundError": { "description": "Not Found", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 404 }, "name": { "example": "NotFoundError" }, "message": { "example": "Requested Item Not Found" } } } ] } } } }, "PermissionResponse": { "description": "Object of available role permissions", "content": { "application/json": { "schema": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } }, "PortLabel": { "description": "Port Label Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } } } } } }, "PortLabels": { "description": "List of Port Labels Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "PortLabelsBulk": { "description": "Result of Port Labels bulk upload", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "description": "Port Label Record", "type": "object", "additionalProperties": false, "properties": { "protocol": { "description": "Protocol", "type": "string", "example": "udp" }, "port": { "description": "Port", "type": "number", "example": 1 }, "default": { "description": "If true, this is default (system) label", "type": "boolean", "example": true }, "hasdefault": { "description": "If true, this port has a default (system) label", "type": "boolean", "example": true }, "hide": { "description": "If true, this is hidden default (system) label", "type": "boolean", "example": false }, "labels": { "description": "Labels for port", "type": "array", "minItems": 1, "maxItems": 10000, "items": { "type": "string" }, "example": [ "test" ] } } } ] } } } } } } }, "PortLabelsProtocols": { "description": "List of Port Labels Protocols Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "Protocol name", "example": "tcp" } } } } } } } } }, "Regions": { "description": "An object which contains response metadata information and a data object containing the region array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of region.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "id of the region", "readOnly": true, "example": "aws_ap-east-1" }, "description": { "type": "string", "description": "description of the", "readOnly": true, "example": "Asia Pacific (Hong Kong)" }, "label": { "type": "string", "readOnly": true, "description": "label of the region.", "example": "ap-east-1" }, "provider": { "type": "string", "readOnly": true, "description": "provider of the region", "example": "aws" }, "region": { "type": "string", "readOnly": true, "description": "region the service is located in.", "example": "us-east-1" } } } } } } } } }, "ResponsePolicies": { "description": "List of Requested Response Policies", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "ResponsePolicy": { "description": "Requested Response Policy", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Response Policy Record", "type": "object", "allOf": [ { "type": "object", "properties": { "config": { "type": "object", "properties": { "alerttypes": { "type": "array", "items": { "type": "string", "enum": [ "all", "start", "ongoing", "end" ], "example": [ "start", "end" ] } }, "severities": { "type": "array", "items": { "type": "string", "enum": [ "all", "low", "medium", "high" ], "example": [ "low", "medium" ] } }, "algorithms": { "type": "array", "items": { "type": "string", "description": "Detection Model (algorithm) name", "example": "all" } }, "categories": { "type": "array", "items": { "type": "string", "description": "Detection Category name", "example": "all" } }, "tracks": { "type": "array", "items": { "type": "string", "enum": [ "all", "dstip", "flowsrcname", "input", "output", "srcip" ], "example": [ "dstip", "srcip" ] } } } }, "description": { "type": "string", "example": "this detects things" }, "name": { "type": "string", "example": "my-rule" }, "enabled": { "type": "boolean", "example": true }, "type": { "type": "string", "enum": [ "alert" ], "example": "alert" } } } ], "properties": { "id": { "type": "string", "description": "Response Policy ID", "example": "0443258d-3217-49a3-8f2a-21ed5aef4bee" }, "plugins": { "type": "array", "items": { "type": "object", "properties": { "adapter": { "type": "string", "description": "Plugin type to be used in the response policy", "example": "syslog" }, "description": { "type": "string", "description": "Plugin description to be used in the response policy", "example": "My Plugin" }, "id": { "type": "string", "description": "Plugin ID to be used in the response policy", "example": "a8899a17-2e34-4d76-a765-57dda8604d06" }, "name": { "type": "string", "description": "Plugin name to be used in the response policy", "example": "My Plugin" }, "type": { "type": "string", "enum": [ "block", "dns", "notification", "traffic" ], "description": "Plugin type to be used in the response policy", "example": "block" } } } } } } ] } } } } } } }, "Role": { "description": "Role response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "required": [ "name", "permissions" ], "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "role id. immutable." }, "name": { "type": "string", "description": "Role Name" }, "description": { "type": "string", "description": "Role Description" }, "canMasquerade": { "type": "boolean", "description": "(resellers only) Whether or not the role can masquerade into sub accounts" }, "canSendFlow": { "type": "boolean", "description": "Whether or not the role can send NetoFlow" }, "system": { "type": "boolean", "description": "Whether or not this is a system role. immutable." }, "permissions": { "type": "array", "maxItems": 1000, "items": { "allOf": [ { "type": "object", "required": [ "resource" ], "additionalProperties": false, "properties": { "resource": { "type": "string", "description": "Resource Name" }, "description": { "type": "string", "description": "Resource description and/or mapping to portal" }, "fetch": { "type": "boolean", "description": "If fetch/get is an available action" }, "create": { "type": "boolean", "description": "If create is an available action" }, "update": { "type": "boolean", "description": "If update is an available action" }, "delete": { "type": "boolean", "description": "If delete is an available action" } } } ] } } } } } } } } }, "SearchRecord": { "description": "An object which contains response metadata information and a data array of records", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "oneOf": [ { "description": "Event Record", "type": "object", "additionalProperties": false, "properties": { "alerttype": { "description": "Type of alert. Eg start, end, ongoing.", "type": "string", "example": "start" }, "algorithm": { "description": "Name of the Detection Model (algorithm) that triggered the alert.", "type": "string", "example": "knownphisher" }, "categories": { "description": "categories of the alert. Eg security, ddos etc", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "security" ] }, "description": { "description": "Description of the alert", "type": "string", "example": "Srcip reputation is a known phisher" }, "dstports": { "example": [ 80, 443 ] }, "duration": { "description": "Time in seconds for the current triggered alert metric.", "type": "integer", "example": 0 }, "end": { "description": "End time of the alert.", "type": "integer", "example": 0 }, "flowsrcnames": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": [ "myrouter.mydomain" ] }, "id": { "type": "string", "readOnly": true, "description": "The ID for this alert.", "example": "7da7af39-04f8-49f7-9b20-74d61b100250" }, "ipinfo": { "description": "An array of ip info objects that contains the netography known enrichment data for an ip at the time of the alert", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "as": { "description": "ASN object that contains the number and org", "type": "object", "additionalProperties": false, "properties": { "number": { "description": "AS Number", "type": "integer", "example": 65001 }, "org": { "description": "AS Org", "type": "string", "example": "WebHostOrg" } } }, "bogon": { "description": "Is this IP bogon?", "type": "boolean", "example": false }, "count": { "description": "Number of times this IP has been seen", "type": "integer", "example": 1 }, "firstseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "geo": { "description": "geo data for this ip", "type": "object", "example": null, "additionalProperties": false, "properties": { "city": { "description": "Name of the city", "type": "string", "example": "" }, "continentcode": { "description": "Continent code", "type": "string", "example": "EU" }, "countrycode": { "description": "Country code", "type": "string", "example": "NL" }, "location": { "description": "Latitude & Longitude Object", "type": "object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude", "type": "number", "minimum": -90, "maximum": 90, "example": 51.9167 }, "lon": { "description": "Longitude", "type": "number", "minimum": -180, "maximum": 180, "example": 34.504 } } }, "postal": { "description": "Postal code", "type": "string", "example": "" }, "subdiso": { "description": "Name of the subdivision iso code", "type": "string", "example": "ZH" }, "subdivisionb": { "description": "Name of the additional subdivision", "type": "string", "example": "" } } }, "ip": { "description": "IP address this info applies to", "type": "string", "example": "10.0.0.1" }, "iprep": { "description": "IP Reputation information for this IP", "type": "object", "additionalProperties": false, "properties": { "categories": { "description": "The IP reputation categories this IP belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "Phishing" ] }, "count": { "description": "Number of IP reputation categories this IP belongs to", "type": "integer", "example": 1 } } }, "lastseen": { "description": "timestamp of when this IP was first seen by Netography", "type": "integer", "example": 1618433146 }, "pdns": { "description": "Passive DNS information for this IP", "type": "object", "additionalProperties": false, "properties": { "count": { "description": "Number of passive DNS records for this IP", "type": "integer", "example": null }, "records": { "description": "The passive DNS records that were found during the event duration", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "rdns": { "description": "Reverse DNS for this ip", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "web01.smarthosten.nl" ] } } } }, "ipinfocount": { "description": "number of IPs extend information was fetched on.", "type": "integer", "example": 2 }, "metrics": { "type": "object", "additionalProperties": false, "properties": { "bits": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "bitsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 624 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 624 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 624 } } }, "packets": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } }, "packetsxrate": { "type": "object", "additionalProperties": false, "properties": { "min": { "description": "The minumum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "max": { "description": "The maximum value for the current triggered alert metric.", "type": "integer", "example": 1 }, "avg": { "description": "The average value for the current triggered alert metric.", "type": "number", "example": 1 }, "sum": { "description": "The sum of the values for the current triggered alert metric.", "type": "number", "example": 1 } } } } }, "rollupperiod": { "description": "Time in seconds looked back for calculating the alert metric.", "type": "integer", "example": 300 }, "rulecount": { "description": "Number of response policies (rules) that fired from this alert", "type": "integer", "example": 0 }, "rules": { "description": "Response policies (rules) that fired with this alert", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [] }, "search": { "description": "NQL used", "type": "string", "example": "((tcpflagsint == 0 && protocol == tcp && srcport != 0 && dstport != 0 && (flowversion == 3 or flowversion == 4)) && flowtype == aws) && (dstip == 10.0.18.65)" }, "severity": { "description": "Severity of the alert.", "type": "string", "example": "medium" }, "sites": { "description": "The site of the alert.", "type": "string", "example": [ "mysite1" ] }, "srcports": { "example": [ 36834, 39954, 46108 ] }, "start": { "description": "Start time of the alert.", "type": "integer", "example": 1618246683 }, "summary": { "description": "Human readable summary of the alert.", "type": "string", "example": "Knownphisher alert has started to dstip 10.0.0.1" }, "tag": { "description": "Tag associated with the alert if applicable", "type": "string" }, "tags": { "description": "Tag associated with the alert if applicable", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "aws", "vpc-id:vpc-04db1588169de0100", "instance-id:i-0048f0897ae2d8b89", "subnet-id:subnet-01a3ecfbad0f2bc59", "instance-id:i-0458e0d3d24637924", "subnet-id:subnet-00a17206163ae6f9a" ] }, "threshold": { "description": "Threshold for this detection model (algorithm)", "type": "string", "example": "count(track_by) >= 1" }, "timestamp": { "description": "Unix timestamp for the alert.", "type": "integer", "example": 1618246748 }, "track": { "description": "The object string that the detection model (algorithm) uses to track, this can be different than the objectfield value).", "type": "string", "example": "srcip 192.168.1.1" }, "track_by": { "description": "The field that identifies the object (dstip, flowsrcname, tag, input, output).", "type": "array", "maxItems": 5, "items": { "type": "string" }, "example": [ "srcip", "dstip" ] }, "updateinterval": { "description": "Time in seconds updates are sent out.", "type": "integer", "example": 300 } } }, { "description": "Audit Log Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "What operation was done to generate the record", "type": "string", "example": "delete" }, "class": { "description": "The audit class of the record", "type": "string", "example": "dashboard" }, "description": { "description": "User summary of the record", "type": "string", "example": "Dashboard widget deleted" }, "id": { "type": "string", "readOnly": true, "description": "The unique ID, as an UUID, of the audit record", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "impersonator": { "description": "The user id of the impersonator of the change", "type": "string", "example": "user@company.com" }, "new_object": { "description": "The new object subject to the audit record", "type": "object", "example": null }, "original_id": { "type": "string", "readOnly": true, "description": "The id of the object subject to the audit record", "example": 860759504 }, "original_object": { "description": "The original object subject to the audit record", "type": "object", "example": null }, "subclass": { "description": "The audit subclass of the record", "type": "string", "example": "widget" }, "timestamp": { "description": "Epoch timestamp", "type": "integer", "example": 1644138287 }, "user": { "description": "The user id of the user of the change", "type": "string", "example": "user@company.com" } } }, { "description": "Block Record", "type": "object" }, { "description": "DNS Record", "type": "object", "additionalProperties": false, "properties": { "accountid": { "description": "Account ID", "type": "string" }, "action": { "description": "Action that was taken on this query (cloud only)", "type": "string" }, "answercount": { "description": "The number of answers returned", "type": "integer" }, "answers": { "type": "array", "items": { "type": "object", "properties": { "type": { "type": "string", "description": "the DNS answer type" }, "rdata": { "type": "string", "description": "the DNS answer rdata" }, "class": { "type": "string", "description": "the DNS answer class" } } } }, "datasrc": { "description": "Device or Cloud Provider name sending dns", "type": "string" }, "id": { "description": "The unique ID, as an UUID, of the DNS record", "type": "string", "example": "5b245fbf-289b-4e33-74f0-69f223b45207" }, "instanceid": { "description": "Instance ID", "type": "string" }, "internal": { "description": "Is this query name for an internal domain", "type": "boolean" }, "label": { "type": "object", "properties": { "ip": { "type": "object", "description": "IP labels for all contexts" }, "port": { "type": "object", "description": "Port labels for all protocols" } } }, "protocol": { "description": "Protocol of the query", "type": "string" }, "provider": { "description": "Is the answer a provider", "type": "boolean" }, "providername": { "description": "The name of the provider", "type": "string" }, "query": { "type": "object", "properties": { "class": { "description": "DNS query class", "type": "string" }, "depth": { "description": "DNS query depth", "type": "integer" }, "domain": { "description": "DNS query domain", "type": "string" }, "host": { "description": "DNS query host", "type": "string" }, "name": { "description": "DNS query name", "type": "string" }, "publicsuffix": { "description": "DNS query domain under which multiple parties that are unaffiliated with the operator of the domain may register subdomains", "type": "string" }, "tld": { "description": "DNS query tld", "type": "string" }, "type": { "description": "DNS query type", "type": "string" } } }, "rcode": { "description": "the DNS rcode", "type": "string" }, "region": { "description": "Region", "type": "string" }, "rtime": { "description": "The time the record was received", "type": "string" }, "site": { "description": "The site name the DNS request was sent from. Site names can be managed in Devices", "type": "string" }, "srcip": { "description": "Source IP of the DNS request", "type": "string" }, "srcport": { "description": "Source port of the DNS request", "type": "integer" }, "timestamp": { "description": "Unix timestamp for the dns request.", "type": "integer", "example": 1618433146 }, "type": { "description": "the DNS Type", "type": "string" }, "version": { "description": "the DNS version", "type": "string" }, "vpcid": { "description": "VPC Id", "type": "string" } } }, { "description": "Flow Record", "type": "object", "additionalProperties": false, "properties": { "action": { "description": "Whether the flow was accepted or rejected. AWS only.", "type": "string", "example": null }, "bits": { "description": "Number of bits.", "type": "integer", "example": 624 }, "bogonsrc": { "description": "Is source IP bogon?", "type": "boolean", "example": false }, "bogondst": { "description": "Is destination IP bogon?", "type": "boolean", "example": false }, "dstas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Destination AS the traffic came from.", "type": "integer", "example": 15169 }, "org": { "description": "Destination AS Organization the traffic came from.", "type": "string", "example": "Google LLC" } } }, "dstgeo": { "type": "object", "description": "Destination Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of destination IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of destination IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the destination IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 25.7634 }, "lon": { "description": "Longitude of the destination IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -80.1886 } } } } }, "dstinternal": { "description": "Is the destination an internal IP?", "type": "boolean", "example": true }, "dstip": { "description": "Destination IP for the flow.", "type": "string", "example": "192.168.2.1" }, "dstiprep": { "type": "object", "description": "Destination IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the destination IP belongs to.", "type": "integer" }, "categories": { "description": "The IP Reputation categories the destination ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null } } }, "dstowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the destination IP owner.", "type": "integer", "example": 64496 }, "org": { "description": "AS Organization of the destination IP owner.", "type": "string", "example": "Transit Provider" } } }, "dstport": { "description": "Destination port for the flow.", "type": "integer", "example": 32400 }, "dstvlan": { "description": "Destination VLAN.", "type": "integer", "example": null }, "duration": { "description": "Duration of the flow in ms.", "type": "integer", "example": 140006 }, "end": { "description": "End of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618433146 }, "flowbrate": { "description": "The rate of bits for this flow. Netflow/VPC flow only", "type": "number", "example": 4.457142857142857 }, "flowprate": { "description": "The rate of packets for this flow. Netflow/VPC flow only", "type": "number", "example": 0.007142857142857143 }, "flowsrcname": { "description": "Device or Cloud Provider name sending flows", "type": "string", "example": "router1.example.com" }, "flowsrcip": { "description": "Device sending IP of flow.", "type": "string", "example": "172.16.1.1" }, "flowtype": { "description": "Type of flow for this flow. Eg. aws, netflow, sflow.", "type": "string", "example": null }, "flowversion": { "description": "Version of the flow being sent.", "type": "integer", "example": null }, "icmpcode": { "description": "ICMP code V10 only.", "type": "string", "example": null }, "icmptype": { "description": "ICMP type", "type": "string", "example": "" }, "ipversion": { "description": "Version of the IP protocol for this flow.", "type": "integer", "example": 4 }, "input": { "description": "Input (index) interface.", "type": "integer", "example": 512 }, "inputalias": { "description": "Alias for input interface.", "type": "string", "example": "router-uplink" }, "inputclasses": { "description": "Interface classes the input interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "inputname": { "description": "Nescription of the input interface.", "type": "string", "example": "ge-0/0/0.0" }, "nexthop": { "description": "IP address of the next hop.", "type": "string", "example": "0.0.0.0" }, "output": { "description": "Output (index) interface.", "type": "integer", "example": 0 }, "outputalias": { "description": "Alias for output interface.", "type": "string", "example": null }, "outputclasses": { "description": "Interface classes the output interface belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": null }, "outputname": { "description": "Name for output interface.", "type": "string", "example": "" }, "packets": { "description": "Number of packets.", "type": "integer", "example": null }, "pbratio": { "description": "Ratio of packets to bits for this flow (packets/bits).", "type": "number", "example": null }, "protocol": { "description": "Protocol of the flow.", "type": "string", "example": "tcp" }, "protocolint": { "description": "Integer representation of the protocol of the flow.", "type": "integer", "example": null }, "site": { "description": "Site for this device/VPC.", "type": "string", "example": "us-east-1" }, "srcas": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "Source AS the traffic came from.", "type": "integer", "example": 7922 }, "org": { "description": "Source AS Organization the traffic came from.", "type": "string", "example": "Comcast Cable Communications LLC" } } }, "srcgeo": { "type": "object", "description": "Source Geolocation Object", "additionalProperties": false, "properties": { "countrycode": { "description": "Country code of source IP.", "type": "string", "example": "US" }, "continentcode": { "description": "Continent of source IP.", "type": "string", "example": "NA" }, "location": { "type": "object", "description": "Latitude & Longitude Object", "additionalProperties": false, "properties": { "lat": { "description": "Latitude of the source IP.", "type": "number", "minimum": -90, "maximum": 90, "example": 38.8597 }, "lon": { "description": "Longitude of the source IP.", "type": "number", "minimum": -180, "maximum": 180, "example": -77.198 } } } } }, "srcinternal": { "description": "Is the source an internal IP?", "type": "boolean", "example": true }, "srcip": { "description": "Source IP for the flow.", "type": "string", "example": "10.0.0.1" }, "srciprep": { "type": "object", "description": "Source IP Reputation Object", "additionalProperties": false, "properties": { "count": { "description": "Number of IP Reputation categories the source IP belongs to.", "type": "integer", "example": null }, "categories": { "description": "The IP Reputation categories the source ip belongs to.", "type": "array", "maxItems": 1000, "items": { "type": "string", "example": null } } } }, "srcowneras": { "type": "object", "description": "Autonymous System Object", "additionalProperties": false, "properties": { "number": { "description": "AS number of the source IP owner.", "type": "integer", "example": 64497 }, "org": { "description": "AS Organization of the source IP owner", "type": "string", "example": "End User ISP Telco" } } }, "srcport": { "description": "Source port for the flow.", "type": "integer", "example": 50187 }, "srcvlan": { "description": "Source VLAN.", "type": "integer", "example": null }, "start": { "description": "Start of the flow if it could be calculated (netflow only)", "type": "integer", "example": 1618423146 }, "tags": { "description": "User defined metadata.", "type": "array", "maxItems": 1000, "items": { "type": "string" }, "example": [ "edge" ] }, "timestamp": { "description": "Unix timestamp for the flow.", "type": "integer", "example": 1618433146 }, "tcpflagsint": { "description": "Integer value representing ALL TCP flags.", "type": "integer", "example": 16 }, "tcpflags": { "type": "object", "description": "TCP Flags Object", "additionalProperties": false, "properties": { "ack": { "description": "Was tcp flag ACK set?", "type": "boolean", "example": false }, "cwr": { "description": "Was tcp flag CWR set?", "type": "boolean", "example": false }, "ece": { "description": "Was tcp flag ECE set?", "type": "boolean", "example": false }, "fin": { "description": "Was tcp flag FIN set?", "type": "boolean", "example": false }, "ns": { "description": "Was tcp flag NS set?", "type": "boolean", "example": false }, "psh": { "description": "Was tcp flag PSH set?", "type": "boolean", "example": false }, "rst": { "description": "Was tcp flag RST set?", "type": "boolean", "example": false }, "syn": { "description": "Was tcp flag SYN set?", "type": "boolean", "example": false }, "urg": { "description": "Was tcp flag URG set?", "type": "boolean", "example": false } } }, "tos": { "description": "Type of service set on the flow.", "type": "integer", "example": 72 } } } ] } } } } } } }, "Tags": { "description": "An array of Tags", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1000, "items": { "type": "object", "required": [ "entitytype", "entityname", "entityid", "tag" ], "additionalProperties": false, "properties": { "entitytype": { "type": "string", "description": "entity this tag is associated with", "enum": [ "device", "flow", "vpc" ], "example": "flow" }, "entityname": { "type": "string", "description": "name of the entity", "example": "Flow Rule 1" }, "entityid": { "type": "string", "readOnly": true, "description": "id of the entity", "example": 325067628 }, "tag": { "type": "string", "description": "value of the tag", "example": "mytag" } } } } } } } } }, "ThresholdAutomatonConfig": { "description": "Threshold Automaton config", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } } } } } }, "ThresholdAutomatonConfigs": { "description": "List of threshold automaton configs for a customer", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Record", "type": "object", "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "algorithm": { "type": "string", "description": "name of detection model", "example": "1ms0rryminer_detection" }, "data_interval": { "type": "string", "description": "defines the how specific a time frame the Threshold override produced by Auto Thresholding applies to.", "example": "1d" }, "data_lookback": { "type": "string", "description": "determines how many previous days aggregate data and Auto Thresholding configuration will use to generate Threshold overrides", "example": "180d" }, "data_window": { "type": "string", "description": "defines the period of over which values are aggregated for Track By aggregates.", "example": "1h" }, "disabled": { "type": "boolean", "description": "disables auto-thresholding for the given automaton", "example": false }, "filters": { "type": "array", "items": { "type": "string" } }, "force_override": { "type": "boolean", "description": "optional, if set will override the default behavior preventing threshold values below the global average", "example": true }, "high_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating high-severity thresholds", "example": 3 }, "med_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating medium-severity thresholds", "example": 2 }, "low_sigma": { "type": "number", "description": "optional, number of standard deviations to use when calculating low-severity thresholds", "example": 1 }, "strategy": { "type": "string", "example": "average", "description": "used to determine the default threshold, either uses the maximum or average of data values." }, "thresholds": { "type": "array", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "track_by": { "type": "array", "description": "values to aggregate data on, should match parent DM track-by fields.", "items": { "type": "string", "example": [ "avg(bits)" ] } }, "update_interval": { "type": "string", "example": "10m" } } } ], "properties": { "customer": { "type": "string", "description": "customer shortname", "example": "xpertdns" } } } ] } } } } } } }, "ThresholdOverrides": { "description": "List of Requested Threshold Overrides", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Override Record", "type": "object", "properties": { "algorithm": { "type": "string" }, "auto": { "type": "boolean" }, "beta": { "type": "boolean" }, "bypassdisplay": { "type": "boolean" }, "bypassrule": { "type": "boolean" }, "createdby": { "type": "string" }, "default": { "type": "boolean" }, "discards": { "type": "array" }, "items": { "type": "string" }, "ndm_score_confidence": { "type": "integer" }, "ndm_score_threat": { "type": "integer" }, "rollupperiod": { "type": "integer" }, "sharedkey": { "type": "boolean" }, "state": { "type": "string" }, "thresholds": { "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "enum": [ "low", "medium", "high" ] }, "threshold": { "type": "string" } } } }, "track": { "type": "string" }, "updateinterval": { "type": "integer" } } } ] } } } } } } }, "ThresholdTrackData": { "description": "List of track values for a given auto threshold", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Threshold Automaton Create or Update Config", "type": "object", "properties": { "average": { "type": "number", "description": "average value for operation", "example": 5176 }, "deviation": { "type": "number", "example": 2741552.2677988047 }, "operation": { "type": "string", "example": "AVERAGE(bits)" }, "threshold": { "type": "array", "description": "array holding values for each configured severity level for the data point.", "items": { "type": "object", "properties": { "level": { "type": "string", "example": "low" }, "value": { "type": "number", "example": 3028123.4945786856 } } } }, "customer": { "type": "string", "description": "Netography customer shortname", "example": "xpertdns" }, "group": { "type": "string", "description": "the specific track (group) the data corresponds to.", "example": "10.99.4.13" }, "algorithm": { "type": "string", "description": "the detection model the threshold values are derived from", "example": "1ms0rryminer_detection" }, "timestamp": { "type": "number", "description": "unix timestamp describing when the threshold values were generated", "example": 1725449961304 } } } ] } } } } } } }, "Timeseries": { "description": "An object which contains response metadata information and a data object containing the Time Series array.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "An array of arrays. The outer array is per series requested, the inner is the Data Series Points for that series.", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "data": { "type": "array", "maxItems": 1000, "items": { "description": "Series data formatted per the format parameter", "anyOf": [ { "type": "object", "description": "default series format", "additionalProperties": false, "properties": { "key": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "value": { "description": "data point value", "example": 10669651 } } }, { "type": "object", "description": "amcharts series format", "additionalProperties": false, "properties": { "date": { "type": "integer", "description": "Unix Timestamp in milliseconds.", "example": 1617902100000 }, "field1": { "description": "data point value", "example": 10669651 } } }, { "type": "array", "description": "d3 series format", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "array", "description": "highcharts series format [ unix timestamp (ms), value ]", "items": { "type": "integer" }, "minItems": 2, "maxItems": 2, "example": [ 1617902100000, 10669651 ] }, { "type": "object", "description": "png series format", "additionalProperties": false, "properties": { "name": { "type": "string", "description": "value of the field property in the request", "example": "10.0.18.80" }, "buckets": { "type": "array", "maxItems": 1000, "items": { "type": "object" }, "description": "array of the raw data in the image, in the default format", "example": [ { "key": "10.0.18.80", "value": 12766 } ] }, "img": { "type": "string", "description": "base64 encoded png image", "example": "iVBORw0KGgoAAAANSUhEUgAABwgAAASw...TkSuQmCC" } } } ] } } } } } } } } } }, "TrafficDetectionModel": { "description": "Requested Traffic Detection Model", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "maxItems": 1, "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "TrafficDetectionModels": { "description": "List of Requested Traffic Detection Models", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "description": "Traffic Detection Model Record", "type": "object", "allOf": [ { "type": "object", "properties": { "bypassdisplay": { "description": "If true, portal and API will not display new events", "type": "boolean", "example": false }, "bypassrule": { "description": "If true, alerts will not be processed by policies and integrations", "type": "boolean", "example": false }, "categories": { "description": "Categories for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "system" ] }, "description": { "description": "Detection model description", "type": "string", "example": "detection model description" }, "discards": { "description": "Discard lists are NQL statements that if matched do not get processed through the event. It enables skipping certain combinations without disabling the detection model", "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "enabled": { "description": "If true, the detection model is enabled", "type": "boolean", "example": true }, "factors": { "description": "Factors for the detection model", "type": "array", "items": { "type": "string" }, "example": [ "srcip" ] }, "name": { "description": "Name of the detection model", "type": "string", "example": "new_ndm_name" }, "rollupperiod": { "description": "The lookback period for the detection model. Min 15 seconds. Max 1 hour (3600)", "type": "integer", "example": 300 }, "search_by": { "description": "Search criteria for the detection model", "type": "array", "items": { "type": "object", "properties": { "search": { "type": "array", "items": { "type": "string" }, "example": [ "bits > 10000" ] }, "type": { "type": "string", "example": "all" } } }, "example": [ { "search": [ "bits > 10000" ], "type": "all" } ] }, "thresholds": { "description": "Thresholds for the detection model", "type": "array", "items": { "type": "object", "properties": { "severity": { "type": "string", "example": "medium" }, "threshold": { "type": "string", "example": "average(bits) > 500" } } }, "example": [ { "severity": "medium", "threshold": "average(bits) > 500" } ] }, "track_by": { "description": "Tracking criteria for the detection model", "type": "array", "items": { "type": "array", "items": { "type": "string" } }, "example": [ [ "srcip" ] ] }, "updateinterval": { "description": "When ongoing updates should be sent. Max 6 hours (21600). 0 for disabled", "type": "integer", "example": 0 }, "algo_record_type": { "description": "The context of record to be used for the detection model", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" } } } ], "properties": { "algo_type": { "description": "Detection model type", "type": "string", "example": "TDM" }, "beta": { "description": "If true, it's a beta detection model", "type": "boolean", "example": false }, "created": { "description": "The time at which record was created", "type": "integer", "example": 1640995200 }, "id": { "description": "Detection model ID", "type": "string", "example": "127e5619-5c3c-4314-9d74-c11d07c9361e" }, "recommended": { "description": "If true, it's a recomended detection model", "type": "boolean", "example": false }, "subscription": { "description": "Subscription for the detection model", "type": "object", "properties": { "all": { "type": "string", "example": "subscribed" } }, "example": { "all": "subscribed" } }, "subscriptiontype": { "description": "Subscription type for the detection model", "type": "string", "example": "optout" }, "system": { "description": "If true, it's a system detection model", "type": "boolean", "example": false }, "systemdefault": { "description": "If true, it's a system default detection model", "type": "boolean", "example": false }, "updated": { "description": "The time at which record was was last updated", "type": "integer", "example": 1641995200 } } } ] } } } } } } }, "UnauthorizedError": { "description": "Access token is missing or invalid", "content": { "application/json": { "schema": { "allOf": [ { "type": "object", "required": [ "status", "name", "message" ], "additionalProperties": false, "properties": { "status": { "description": "API response code: \n * 4xx - you did something dumb\n * 5xx - we did something dumb\n", "type": "integer", "readOnly": true, "format": "int32", "example": 500 }, "name": { "description": "They type of error", "type": "string", "readOnly": true, "example": "InternalServerError" }, "message": { "description": "description of the error", "type": "string", "readOnly": true, "example": "error message" } } }, { "type": "object", "properties": { "status": { "example": 401 }, "name": { "example": "UnauthorizedError" }, "message": { "example": "Access Denied" } } } ] } } } }, "User": { "description": "User response object", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result data", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "User ID", "example": "fb691e09-a185-4033-a91c-817d68b1b115" }, "given_name": { "description": "First or Given name of the user", "type": "string", "example": "Jerry" }, "family_name": { "description": "Last or Family name of the user", "type": "string", "example": "McGuire" }, "email": { "description": "User's email. This is the main identifier and cannot be changed.", "type": "string", "example": "no-reply@netography.com" }, "nickname": { "description": "User's nickname. Optional", "example": "Skippy" }, "picture": { "description": "HTTPS URL to a user's profile picture. Optional", "example": "https://www.gfxmag.com/wp-content/uploads/2017/01/racing-car-emoji-vector-icon.png" }, "roles": { "type": "array", "maxItems": 1, "items": { "type": "string" }, "description": "An array containing strings which include the role name the user should be assigned to.", "example": [ "app_admin" ] } } } } } } } }, "Vpc": { "description": "Object of a VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "object", "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } }, "VpcStatuses": { "description": "List of VPC States.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "readOnly": true, "description": "The ID for the vpc. This is immutable.", "example": 892079680 }, "name": { "description": "The name of the VPC.", "type": "string", "example": "prod-vpc-east" }, "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure", "aws" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events", "type": "string", "enum": [ "s3", "kinesis", "blobstorage", "pubsub", "objectstorage" ], "example": "blobstorage" }, "enabled": { "description": "If vpc flow collection is activated", "type": "boolean", "example": true }, "time": { "description": "Time stamp of last attempted poll", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "success": { "description": "true if last poll was successful", "type": "boolean", "example": true, "readOnly": true }, "attempt": { "description": "Count of job restarts since last reset.", "type": "integer", "example": 0, "readOnly": true }, "created": { "description": "The time at which config was created.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "lastupdated": { "description": "The last time config was changed.", "type": "string", "example": "2022-10-18T17:53:53Z", "readOnly": true }, "error": { "description": "Array of error messages (if known)", "type": "array", "items": { "type": "string" }, "example": [ "Invalid credentials" ], "readOnly": true }, "progress": { "type": "array", "description": "Array of output from checkpoints or steps to complete the capture of flow.", "items": { "type": "object", "properties": { "step": { "type": "string", "readOnly": true, "description": "A check point step.", "example": "COS Session Created" }, "description": { "type": "string", "readOnly": true, "description": "Details about this step.", "example": "Create client session connection to cloud object storage." }, "error": { "type": "string", "readOnly": true, "description": "Error encountered during this step." }, "status": { "type": "string", "readOnly": true, "description": "Status of this step.", "example": "pass" } } }, "readOnly": true } } } } } } } } }, "Vpcs": { "description": "List of VPCs Requested", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "description": "Result set from API call", "type": "array", "maxItems": 1000, "items": { "additionalProperties": false, "properties": { "id": { "description": "VPC id", "readOnly": true, "type": "string", "example": "731612398" } }, "oneOf": [ { "description": "AWS Kinesis Parameters.", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "shardid", "stream", "awsauthtype" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "kinesis" ], "example": "kinesis" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "shardid": { "type": "string", "description": "Kinesis shard id", "example": "shardId-000000000000" }, "stream": { "description": "Kinesis stream", "type": "string", "example": "flowlogstream" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } } } }, { "description": "AWS S3 Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "bucket", "bucketregion", "region", "awsauthtype" ], "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "aws" ], "example": "aws" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "s3" ], "example": "s3" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "bucket": { "type": "string", "description": "S3 bucket", "example": "flowlogs" }, "bucketregion": { "type": "string", "description": "Region this S3 bucket is in.", "example": "us-east-1" }, "hive": { "type": "string", "description": "S3 Hive-compatible prefix" }, "prefix": { "type": "string", "description": "S3 flow log path prefix", "example": "AWSLogs/123456/vpcflowlogs/us-east-1/" }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east-1" }, "sqsurl": { "type": "string", "description": "SQS URL of S3 events", "example": "https://sqs.us-east-1.amazonaws.com/123456/flowlogs" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] }, "awsauthtype": { "description": "

The method of authentication to use with AWS. Valid options are:

  • AccessKey: indicates key/secret auth. accesskeyid and accesssecret fields are then required.
  • RoleARN indicates that role auth. The role object is then required.
\n", "type": "string", "enum": [ "AccessKey", "RoleARN" ] }, "accesskeyid": { "description": "AWS accesskey id. Required for AccessKey auth type.", "type": "string" }, "accesssecret": { "description": "AWS Access secret. Required for AccessKey auth type.", "type": "string" }, "role": { "description": "object containing role authentication data. Required for RoleARN auth type.", "type": "object", "properties": { "arn": { "description": "ARN used to authenticate the flow source", "type": "string", "example": "arn:aws:iam::464179634201:role/Extension" } } }, "vpcid": { "description": "VPC ID of the source, applicable and required only for dns traffictype", "type": "string" } } }, { "description": "Azure Blobstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "accountname", "accountkey", "containername", "networksecuritygroup", "resourcegroup", "subscriptionid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "azure" ], "example": "azure" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "blobstorage" ], "example": "blobstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "eastus" }, "accountname": { "type": "string", "description": "Azure Storage Account's Access Name", "example": "securitygroupdiag" }, "accountkey": { "type": "string", "description": "Azure Storage Account's Access Key", "example": "45KiBH8ErtaU5jBLUsP3zow6XyA11fqLeUeSrQ==" }, "containername": { "type": "string", "description": "Azure Storage Account's Container Name", "example": "insights-logs-networksecuritygroupflowevent" }, "networksecuritygroup": { "type": "string", "description": "Azure Network Security Group's Name", "example": "NSG1" }, "resourcegroup": { "type": "string", "description": "Azure Network Security Group's Resource Group", "example": "SEC-USA-GROUP" }, "subscriptionid": { "type": "string", "description": "Azure Network Security Group's subscription ID", "example": "45DD9999-Q333-22BB-33AA-A0000F000C00" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "GCP PubSub Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "projectid", "subid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "gcp" ], "example": "gcp" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "pubsub" ], "example": "pubsub" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow", "dns" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-sanjose-1" }, "projectid": { "type": "string", "description": "GCP Project ID", "example": "security-235d" }, "subid": { "type": "string", "description": "GCP PubSub Subscription ID", "example": "ggl-sec-netography-test-id" }, "samplepercent": { "description": "Sample Rate Percent", "type": "integer", "format": "int32", "minimum": 1, "maximum": 100 }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "IBM Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "apikey", "bucket", "serviceinstanceid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "ibm" ], "example": "ibm" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-east" }, "apikey": { "type": "string", "description": "IBM Objectstorage API key that is associated for the Service ID.", "example": "qSsdZPS7nCupBBEH9r83-0QswQrTrhT13Os1S" }, "bucket": { "type": "string", "description": "The Objectstorage bucket name.", "example": "flowlogs" }, "prefix": { "type": "string", "description": "Flow log path prefix", "example": "folder" }, "serviceinstanceid": { "type": "string", "description": "Unique identifier for the instance of Object Storage the credential accesses. This is also referred to as a service credential.", "example": "crn:v1:bluemix:public:cloud-object-storage:global:a/d05b00aeabbe4f578d3c4e83a6c82f62:9f95b4c8-f29a-4360-b326-560e2dbca522::" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } }, { "description": "Oracle Objectstorage Parameters", "type": "object", "required": [ "flowtype", "flowresource", "name", "enabled", "samplerate", "region", "bucket", "tenancy", "userid" ], "additionalProperties": false, "properties": { "flowtype": { "description": "The VPC's flowtype", "type": "string", "enum": [ "oracle" ], "example": "oracle" }, "flowresource": { "description": "The VPC's resource used to transmit flow events.", "type": "string", "enum": [ "objectstorage" ], "example": "objectstorage" }, "traffictype": { "description": "The VPC's traffic type. Can't be changed at updating.", "type": "string", "enum": [ "flow" ], "example": "flow" }, "name": { "description": "The name of the VPC. Eg. prod-vpc-east", "type": "string", "example": "prod-us-east-1" }, "enabled": { "description": "If this VPC is enabled or disabled.", "type": "boolean", "example": true }, "samplerate": { "description": "The samplerate of flows this VPC will send. Between 1 and 65535.", "type": "integer", "format": "int32", "minimum": 1, "maximum": 65535, "example": 1 }, "region": { "type": "string", "description": "The region the VPC is in. See Get VPC regions by flowtype for a list of valid regions.\n", "example": "us-ashburn-1" }, "bucket": { "type": "string", "description": "The Oracle Objectstorage bucket name.", "example": "oci-logs._flowlogs.ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwo233cmwf4weryty4eb3ypgyzhuq" }, "tenancy": { "type": "string", "description": "Every Oracle Cloud Infrastructure resource has an Oracle-assigned unique ID called an Oracle Cloud Identifier (OCID).", "example": "ocid1.tenancy.oc1..aaaaaaaawho6ghbcze3r7oxlqjciqwrergf46fqnfppyv4eb3ypgyzhuq" }, "userid": { "type": "string", "description": "Oracle assigns each user a unique ID called an Oracle Cloud ID (OCID).", "example": "ocid1.user.oc1..aaaaaaaahvu26nhp2io7bujstpdk6drgrgtoxdfvpz3dxfc4hsy4sp2q" }, "prefix": { "type": "string", "description": "Optional folder prefix", "example": "folder" }, "tags": { "description": "An array of strings to tag every flow from this VPC with.", "type": "array", "items": { "type": "string" }, "example": [ "us-traffic", "prod-traffic" ] } } } ] } } } } } } }, "DNSDevice": { "description": "Requested DNS Device", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } }, "DNSDevices": { "description": "List of Requested DNS Devices", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": false, "properties": { "meta": { "type": "object", "additionalProperties": false, "readOnly": true, "properties": { "code": { "description": "API response code. 200 ok, 400 you did something wrong. 500 we did something wrong", "type": "integer", "readOnly": true, "format": "int32", "example": 200 }, "count": { "description": "Number of documents retrieved or updated.", "type": "integer", "readOnly": true, "format": "int32", "example": 1 } } }, "data": { "type": "array", "items": { "allOf": [ { "type": "object", "description": "Response schema for a single DNS device.", "properties": { "id": { "type": "string", "description": "Unique identifier for the DNS device." }, "name": { "type": "string", "description": "Name of the DNS device." }, "type": { "type": "string", "description": "Type of the DNS device." }, "site": { "type": "string", "description": "Site location of the DNS device." }, "enabled": { "type": "boolean", "description": "Whether the DNS device is enabled." } }, "required": [ "id", "name", "type", "site", "enabled" ] } ] } } } } } } } }, "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" } } } }