Connector API

The Synqly Connector APIs provide a unifying interface and data model for all supported service Providers.

See the Synqly Overview for more information.

Download OpenAPI description
Languages
Servers
Synqly
https://api.synqly.com/

Assets

Operations

Edr

Operations

Query Endpoints

Request

Returns a list of endpoint assets matching the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of endpoint assets to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/endpoints?cursor=string&filter=string&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objects(ocsfv1.3.0inventoryinfoInventoryInfo)required

List of endpoint assets that match the query.

result[].​activity_idinteger(ocsfv1.3.0inventoryinfoActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Log: The discovered information is via a log. 2 - Collect: The discovered information is via a collection process. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result[].​category_uidinteger(ocsfv1.3.0inventoryinfoCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.

result[].​class_uidinteger(ocsfv1.3.0inventoryinfoClassUid)required

ClassUid is an enum, and the following values are allowed. 5001 - DeviceInventoryInfo: Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.

result[].​deviceobject(ocsfv1.3.0inventoryinfoDevice)required

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result[].​device.​type_idinteger(ocsfv1.3.0inventoryinfoDevice_TypeId)required
result[].​device.​agent_listArray of objects or null(ocsfv1.3.0inventoryinfoAgent)

A list of agent objects associated with a device, endpoint, or resource.

result[].​device.​autoscale_uidstring or null

The unique identifier of the cloud autoscale configuration.

result[].​device.​boot_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​boot_time_dtstring or null(date-time)

The time the system was booted.

result[].​device.​containerobject(ocsfv1.3.0inventoryinfoContainer)

The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

result[].​device.​created_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​created_time_dtstring or null(date-time)

The time when the device was known to have been created.

result[].​device.​descstring or null

The description of the device, ordinarily as reported by the operating system.

result[].​device.​domainstring or null

The network domain where the device resides. For example: work.example.com.

result[].​device.​first_seen_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​first_seen_time_dtstring or null(date-time)

The initial discovery time of the device.

result[].​device.​groupsArray of objects or null(ocsfv1.3.0inventoryinfoGroup)

The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"].

result[].​device.​hostnamestring(ocsfv1.3.0inventoryinfoHostname)

Unique name assigned to a device connected to a computer network. A domain name in general is an Internet address that can be resolved through the Domain Name System (DNS). For example: r2-d2.example.com.

result[].​device.​hw_infoobject(ocsfv1.3.0inventoryinfoDeviceHwInfo)

The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.

result[].​device.​hypervisorstring or null

The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.

result[].​device.​imageobject(ocsfv1.3.0inventoryinfoImage)

The Image object provides a description of a specific Virtual Machine (VM) or Container image. Defined by D3FEND d3f:ContainerImage.

result[].​device.​imeistring or null

The International Mobile Station Equipment Identifier that is associated with the device.

result[].​device.​instance_uidstring or null

The unique identifier of a VM instance.

result[].​device.​interface_namestring or null

The name of the network interface (e.g. eth2).

result[].​device.​interface_uidstring or null

The unique identifier of the network interface.

result[].​device.​ipstring(ocsfv1.3.0inventoryinfoIPAddress)

Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example, 192.168.200.24 or 2001:0db8:85a3:0000:0000:8a2e:0370:7334.

result[].​device.​ip_addressesArray of strings or null

A list of IP addresses available on the device

result[].​device.​is_compliantboolean or null

The event occurred on a compliant device.

result[].​device.​is_managedboolean or null

The event occurred on a managed device.

result[].​device.​is_personalboolean or null

The event occurred on a personal device.

result[].​device.​is_trustedboolean or null

The event occurred on a trusted device.

result[].​device.​last_seen_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​last_seen_time_dtstring or null(date-time)

The most recent discovery time of the device.

result[].​device.​locationobject(ocsfv1.3.0inventoryinfoLocation)

The Geo Location object describes a geographical location, usually associated with an IP address. Defined by D3FEND d3f:PhysicalLocation.

result[].​device.​macstring(ocsfv1.3.0inventoryinfoMACAddress)

Media Access Control (MAC) address. For example: 18:36:F3:98:4F:9A.

result[].​device.​mac_addressesArray of strings or null

A list of MAC addresses available on the device

result[].​device.​modified_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​modified_time_dtstring or null(date-time)

The time when the device was last known to have been modified.

result[].​device.​namestring or null

The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

result[].​device.​namespace_pidinteger or null

If running under a process namespace (such as in a container), the process identifier within that process namespace.

result[].​device.​netbios_namesArray of strings or null

A list of NetBIOS names available on the device

result[].​device.​network_interfacesArray of objects or null(ocsfv1.3.0inventoryinfoNetworkInterface)

The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

result[].​device.​network_statusstring or null

The network isolation status of the endpoiint

result[].​device.​network_status_idinteger(ocsfv1.3.0inventoryinfoDevice_NetworkStatusId)

DeviceNetworkStatusId is an enum, and the following values are allowed. 1 - NotIsolated: Device is not isolated from the network. 2 - Isolated: Device is isolated from the network. 99 - Unknown: The network isolation status is unknown.

result[].​device.​orgobject(ocsfv1.3.0inventoryinfoOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result[].​device.​osobject(ocsfv1.3.0inventoryinfoOs)

The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows. Defined by D3FEND d3f:OperatingSystem.

result[].​device.​ownerobject(ocsfv1.3.0inventoryinfoUser)

The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND d3f:UserAccount.

result[].​device.​regionstring or null

The region where the virtual machine is located. For example, an AWS Region.

result[].​device.​risk_levelstring or null

The risk level, normalized to the caption of the risk_level_id value.

result[].​device.​risk_level_idinteger(ocsfv1.3.0inventoryinfoDevice_RiskLevelId)

DeviceRiskLevelId is an enum, and the following values are allowed. 0 - Info 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

result[].​device.​risk_scoreinteger or null

The risk score as reported by the event source.

result[].​device.​subnetstring(ocsfv1.3.0inventoryinfoSubnet)

The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet.

For example:
  • 192.168.1.0/24
  • 2001:0db8:85a3:0000::/64

result[].​device.​subnet_uidstring or null

The unique identifier of a virtual subnet.

result[].​device.​sw_infoArray of objects or null(ocsfv1.3.0inventoryinfoProduct)

The list of software contained on a device

result[].​device.​typestring or null

The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, plc, scada, dcs, cnc, scientific, medical, lighting, energy, transportation other.

result[].​device.​uidstring or null

The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.

result[].​device.​uid_altstring or null

An alternate unique identifier of the device if any. For example the ActiveDirectory DN.

result[].​device.​vendorobject(ocsfv1.3.0inventoryinfoOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result[].​device.​vlan_uidstring or null

The Virtual LAN identifier.

result[].​device.​vpc_uidstring or null

The unique identifier of the Virtual Private Cloud (VPC).

result[].​device.​zonestring or null

The network zone or LAN segment.

result[].​metadataobject(ocsfv1.3.0inventoryinfoMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result[].​metadata.​productobject(ocsfv1.3.0inventoryinfoProduct)required

The Product object describes characteristics of a software product.

result[].​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​metadata.​product.​featureobject(ocsfv1.3.0inventoryinfoFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​metadata.​product.​namestring or null

The name of the product.

result[].​metadata.​product.​pathstring or null

The installation path of the product.

result[].​metadata.​product.​uidstring or null

The unique identifier of the product.

result[].​metadata.​product.​url_stringstring(ocsfv1.3.0inventoryinfoURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result[].​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result[].​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result[].​metadata.​extensionobject(ocsfv1.3.0inventoryinfoExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result[].​metadata.​extensionsArray of objects or null(ocsfv1.3.0inventoryinfoExtension)

The schema extensions used to create the event.

result[].​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result[].​metadata.​log_levelstring or null

The audit level at which an event was generated.

result[].​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result[].​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result[].​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result[].​metadata.​logged_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result[].​metadata.​loggersArray of objects or null(ocsfv1.3.0inventoryinfoLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result[].​metadata.​modified_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result[].​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result[].​metadata.​processed_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result[].​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result[].​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result[].​metadata.​tenant_uidstring or null

The unique tenant identifier.

result[].​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result[].​severity_idinteger(ocsfv1.3.0inventoryinfoSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result[].​timeinteger(ocsfv1.3.0inventoryinfoTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​type_uidinteger(ocsfv1.3.0inventoryinfoTypeUid)required

TypeUid is an enum, and the following values are allowed. 500100 - Unknown 500101 - Log: The discovered information is via a log. 500102 - Collect: The discovered information is via a collection process. 500199 - Other

result[].​activity_namestring or null

The event activity name, as defined by the activity_id.

result[].​actorobject(ocsfv1.3.0inventoryinfoActor)

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

result[].​apiobject(ocsfv1.3.0inventoryinfoApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result[].​category_namestring or null

The event category name, as defined by category_uid value: Discovery.

result[].​cloudobject(ocsfv1.3.0inventoryinfoCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result[].​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result[].​custom_fieldsobject(ocsfv1.3.0inventoryinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result[].​end_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​end_time_dtstring or null(date-time)

The end time of a time period, or the time of the most recent event included in the aggregate event.

result[].​enrichmentsArray of objects or null(ocsfv1.3.0inventoryinfoEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result[].​messagestring or null

The description of the event/finding, as defined by the source.

result[].​observablesArray of objects or null(ocsfv1.3.0inventoryinfoObservable)

The observables associated with the event or a finding.

result[].​osintArray of objects or null(ocsfv1.3.0inventoryinfoOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result[].​raw_datastring or null

The raw event/finding data as received from the source.

result[].​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result[].​start_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​start_time_dtstring or null(date-time)

The start time of a time period, or the time of the least recent event included in the aggregate event.

result[].​statusstring or null

The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

result[].​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result[].​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result[].​status_idinteger(ocsfv1.3.0inventoryinfoStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Success 2 - Failure 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result[].​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result[].​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result[].​type_namestring or null

The event/finding type name, as defined by the type_uid.

result[].​unmappedobject(ocsfv1.3.0inventoryinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Get Endpoint

Request

Gets a single endpoint assets matching the UID from the token-linked EDR source.

Path
idstring(Id)required
curl -i -X GET \
  'https://api.synqly.com/v1/edr/endpoints/{id}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultobject(ocsfv1.3.0inventoryinfoInventoryInfo)required

Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.

result.​activity_idinteger(ocsfv1.3.0inventoryinfoActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Log: The discovered information is via a log. 2 - Collect: The discovered information is via a collection process. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result.​category_uidinteger(ocsfv1.3.0inventoryinfoCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.

result.​class_uidinteger(ocsfv1.3.0inventoryinfoClassUid)required

ClassUid is an enum, and the following values are allowed. 5001 - DeviceInventoryInfo: Device Inventory Info events report device inventory data that is either logged or proactively collected. For example, when collecting device information from a CMDB or running a network sweep of connected devices.

result.​deviceobject(ocsfv1.3.0inventoryinfoDevice)required

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result.​device.​type_idinteger(ocsfv1.3.0inventoryinfoDevice_TypeId)required
result.​device.​agent_listArray of objects or null(ocsfv1.3.0inventoryinfoAgent)

A list of agent objects associated with a device, endpoint, or resource.

result.​device.​autoscale_uidstring or null

The unique identifier of the cloud autoscale configuration.

result.​device.​boot_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​device.​boot_time_dtstring or null(date-time)

The time the system was booted.

result.​device.​containerobject(ocsfv1.3.0inventoryinfoContainer)

The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

result.​device.​created_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​device.​created_time_dtstring or null(date-time)

The time when the device was known to have been created.

result.​device.​descstring or null

The description of the device, ordinarily as reported by the operating system.

result.​device.​domainstring or null

The network domain where the device resides. For example: work.example.com.

result.​device.​first_seen_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​device.​first_seen_time_dtstring or null(date-time)

The initial discovery time of the device.

result.​device.​groupsArray of objects or null(ocsfv1.3.0inventoryinfoGroup)

The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"].

result.​device.​hostnamestring(ocsfv1.3.0inventoryinfoHostname)

Unique name assigned to a device connected to a computer network. A domain name in general is an Internet address that can be resolved through the Domain Name System (DNS). For example: r2-d2.example.com.

result.​device.​hw_infoobject(ocsfv1.3.0inventoryinfoDeviceHwInfo)

The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.

result.​device.​hypervisorstring or null

The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.

result.​device.​imageobject(ocsfv1.3.0inventoryinfoImage)

The Image object provides a description of a specific Virtual Machine (VM) or Container image. Defined by D3FEND d3f:ContainerImage.

result.​device.​imeistring or null

The International Mobile Station Equipment Identifier that is associated with the device.

result.​device.​instance_uidstring or null

The unique identifier of a VM instance.

result.​device.​interface_namestring or null

The name of the network interface (e.g. eth2).

result.​device.​interface_uidstring or null

The unique identifier of the network interface.

result.​device.​ipstring(ocsfv1.3.0inventoryinfoIPAddress)

Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example, 192.168.200.24 or 2001:0db8:85a3:0000:0000:8a2e:0370:7334.

result.​device.​ip_addressesArray of strings or null

A list of IP addresses available on the device

result.​device.​is_compliantboolean or null

The event occurred on a compliant device.

result.​device.​is_managedboolean or null

The event occurred on a managed device.

result.​device.​is_personalboolean or null

The event occurred on a personal device.

result.​device.​is_trustedboolean or null

The event occurred on a trusted device.

result.​device.​last_seen_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​device.​last_seen_time_dtstring or null(date-time)

The most recent discovery time of the device.

result.​device.​locationobject(ocsfv1.3.0inventoryinfoLocation)

The Geo Location object describes a geographical location, usually associated with an IP address. Defined by D3FEND d3f:PhysicalLocation.

result.​device.​macstring(ocsfv1.3.0inventoryinfoMACAddress)

Media Access Control (MAC) address. For example: 18:36:F3:98:4F:9A.

result.​device.​mac_addressesArray of strings or null

A list of MAC addresses available on the device

result.​device.​modified_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​device.​modified_time_dtstring or null(date-time)

The time when the device was last known to have been modified.

result.​device.​namestring or null

The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

result.​device.​namespace_pidinteger or null

If running under a process namespace (such as in a container), the process identifier within that process namespace.

result.​device.​netbios_namesArray of strings or null

A list of NetBIOS names available on the device

result.​device.​network_interfacesArray of objects or null(ocsfv1.3.0inventoryinfoNetworkInterface)

The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

result.​device.​network_statusstring or null

The network isolation status of the endpoiint

result.​device.​network_status_idinteger(ocsfv1.3.0inventoryinfoDevice_NetworkStatusId)

DeviceNetworkStatusId is an enum, and the following values are allowed. 1 - NotIsolated: Device is not isolated from the network. 2 - Isolated: Device is isolated from the network. 99 - Unknown: The network isolation status is unknown.

result.​device.​orgobject(ocsfv1.3.0inventoryinfoOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result.​device.​osobject(ocsfv1.3.0inventoryinfoOs)

The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows. Defined by D3FEND d3f:OperatingSystem.

result.​device.​ownerobject(ocsfv1.3.0inventoryinfoUser)

The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND d3f:UserAccount.

result.​device.​regionstring or null

The region where the virtual machine is located. For example, an AWS Region.

result.​device.​risk_levelstring or null

The risk level, normalized to the caption of the risk_level_id value.

result.​device.​risk_level_idinteger(ocsfv1.3.0inventoryinfoDevice_RiskLevelId)

DeviceRiskLevelId is an enum, and the following values are allowed. 0 - Info 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

result.​device.​risk_scoreinteger or null

The risk score as reported by the event source.

result.​device.​subnetstring(ocsfv1.3.0inventoryinfoSubnet)

The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet.

For example:
  • 192.168.1.0/24
  • 2001:0db8:85a3:0000::/64

result.​device.​subnet_uidstring or null

The unique identifier of a virtual subnet.

result.​device.​sw_infoArray of objects or null(ocsfv1.3.0inventoryinfoProduct)

The list of software contained on a device

result.​device.​typestring or null

The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, plc, scada, dcs, cnc, scientific, medical, lighting, energy, transportation other.

result.​device.​uidstring or null

The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.

result.​device.​uid_altstring or null

An alternate unique identifier of the device if any. For example the ActiveDirectory DN.

result.​device.​vendorobject(ocsfv1.3.0inventoryinfoOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result.​device.​vlan_uidstring or null

The Virtual LAN identifier.

result.​device.​vpc_uidstring or null

The unique identifier of the Virtual Private Cloud (VPC).

result.​device.​zonestring or null

The network zone or LAN segment.

result.​metadataobject(ocsfv1.3.0inventoryinfoMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result.​metadata.​productobject(ocsfv1.3.0inventoryinfoProduct)required

The Product object describes characteristics of a software product.

result.​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result.​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result.​metadata.​product.​featureobject(ocsfv1.3.0inventoryinfoFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result.​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result.​metadata.​product.​namestring or null

The name of the product.

result.​metadata.​product.​pathstring or null

The installation path of the product.

result.​metadata.​product.​uidstring or null

The unique identifier of the product.

result.​metadata.​product.​url_stringstring(ocsfv1.3.0inventoryinfoURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result.​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result.​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result.​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result.​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result.​metadata.​extensionobject(ocsfv1.3.0inventoryinfoExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result.​metadata.​extensionsArray of objects or null(ocsfv1.3.0inventoryinfoExtension)

The schema extensions used to create the event.

result.​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result.​metadata.​log_levelstring or null

The audit level at which an event was generated.

result.​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result.​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result.​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result.​metadata.​logged_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result.​metadata.​loggersArray of objects or null(ocsfv1.3.0inventoryinfoLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result.​metadata.​modified_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result.​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result.​metadata.​processed_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result.​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result.​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result.​metadata.​tenant_uidstring or null

The unique tenant identifier.

result.​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result.​severity_idinteger(ocsfv1.3.0inventoryinfoSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result.​timeinteger(ocsfv1.3.0inventoryinfoTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​type_uidinteger(ocsfv1.3.0inventoryinfoTypeUid)required

TypeUid is an enum, and the following values are allowed. 500100 - Unknown 500101 - Log: The discovered information is via a log. 500102 - Collect: The discovered information is via a collection process. 500199 - Other

result.​activity_namestring or null

The event activity name, as defined by the activity_id.

result.​actorobject(ocsfv1.3.0inventoryinfoActor)

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

result.​apiobject(ocsfv1.3.0inventoryinfoApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result.​category_namestring or null

The event category name, as defined by category_uid value: Discovery.

result.​cloudobject(ocsfv1.3.0inventoryinfoCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result.​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result.​custom_fieldsobject(ocsfv1.3.0inventoryinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result.​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result.​end_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​end_time_dtstring or null(date-time)

The end time of a time period, or the time of the most recent event included in the aggregate event.

result.​enrichmentsArray of objects or null(ocsfv1.3.0inventoryinfoEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result.​messagestring or null

The description of the event/finding, as defined by the source.

result.​observablesArray of objects or null(ocsfv1.3.0inventoryinfoObservable)

The observables associated with the event or a finding.

result.​osintArray of objects or null(ocsfv1.3.0inventoryinfoOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result.​raw_datastring or null

The raw event/finding data as received from the source.

result.​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result.​start_timeinteger(ocsfv1.3.0inventoryinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result.​start_time_dtstring or null(date-time)

The start time of a time period, or the time of the least recent event included in the aggregate event.

result.​statusstring or null

The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

result.​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result.​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result.​status_idinteger(ocsfv1.3.0inventoryinfoStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Success 2 - Failure 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result.​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result.​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result.​type_namestring or null

The event/finding type name, as defined by the type_uid.

result.​unmappedobject(ocsfv1.3.0inventoryinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

metaobject(MetaResponse)
Response
application/json
{ "result": { "activity_id": 0, "activity_name": "string", "actor": {}, "api": {}, "category_name": "string", "category_uid": 0, "class_uid": 0, "cloud": {}, "count": 0, "custom_fields": {}, "device": {}, "duration": 0, "end_time": 0, "end_time_dt": "2019-08-24T14:15:22Z", "enrichments": [], "message": "string", "metadata": {}, "observables": [], "osint": [], "raw_data": "string", "severity": "string", "severity_id": 0, "start_time": 0, "start_time_dt": "2019-08-24T14:15:22Z", "status": "string", "status_code": "string", "status_detail": "string", "status_id": 0, "time": 0, "time_dt": "2019-08-24T14:15:22Z", "timezone_offset": 0, "type_name": "string", "type_uid": 0, "unmapped": {} }, "meta": { "stats": {}, "api": {} } }

Query Applications

Request

Returns a list of applications matching the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of applications to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/applications?cursor=string&filter=string&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objects(ocsfv1.3.0softwareinfoSoftwareInfo)required

List of applications that match the query.

result[].​activity_idinteger(ocsfv1.3.0softwareinfoActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Log: The discovered information is via a log. 2 - Collect: The discovered information is via a collection process. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result[].​category_uidinteger(ocsfv1.3.0softwareinfoCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.

result[].​class_uidinteger(ocsfv1.3.0softwareinfoClassUid)required

ClassUid is an enum, and the following values are allowed. 5090 - DeviceSoftwareInfo: Device Software Info events report device software data that is either logged or proactively collected.

result[].​metadataobject(ocsfv1.3.0softwareinfoMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result[].​metadata.​productobject(ocsfv1.3.0softwareinfoProduct)required

The Product object describes characteristics of a software product.

result[].​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​metadata.​product.​featureobject(ocsfv1.3.0softwareinfoFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​metadata.​product.​namestring or null

The name of the product.

result[].​metadata.​product.​pathstring or null

The installation path of the product.

result[].​metadata.​product.​uidstring or null

The unique identifier of the product.

result[].​metadata.​product.​url_stringstring(ocsfv1.3.0softwareinfoURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result[].​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result[].​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result[].​metadata.​extensionobject(ocsfv1.3.0softwareinfoExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result[].​metadata.​extensionsArray of objects or null(ocsfv1.3.0softwareinfoExtension)

The schema extensions used to create the event.

result[].​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result[].​metadata.​log_levelstring or null

The audit level at which an event was generated.

result[].​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result[].​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result[].​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result[].​metadata.​logged_timeinteger(ocsfv1.3.0softwareinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result[].​metadata.​loggersArray of objects or null(ocsfv1.3.0softwareinfoLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result[].​metadata.​modified_timeinteger(ocsfv1.3.0softwareinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result[].​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result[].​metadata.​processed_timeinteger(ocsfv1.3.0softwareinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result[].​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result[].​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result[].​metadata.​tenant_uidstring or null

The unique tenant identifier.

result[].​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result[].​productobject(ocsfv1.3.0softwareinfoProduct)required

The Product object describes characteristics of a software product.

result[].​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​product.​featureobject(ocsfv1.3.0softwareinfoFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​product.​namestring or null

The name of the product.

result[].​product.​pathstring or null

The installation path of the product.

result[].​product.​uidstring or null

The unique identifier of the product.

result[].​product.​url_stringstring(ocsfv1.3.0softwareinfoURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​severity_idinteger(ocsfv1.3.0softwareinfoSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result[].​timeinteger(ocsfv1.3.0softwareinfoTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​type_uidinteger(ocsfv1.3.0softwareinfoTypeUid)required

TypeUid is an enum, and the following values are allowed. 509000 - Unknown 509001 - Log: The discovered information is via a log. 509002 - Collect: The discovered information is via a collection process. 509099 - Other

result[].​activity_namestring or null

The event activity name, as defined by the activity_id.

result[].​apiobject(ocsfv1.3.0softwareinfoApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result[].​category_namestring or null

The event category name, as defined by category_uid value: Discovery.

result[].​cloudobject(ocsfv1.3.0softwareinfoCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result[].​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result[].​custom_fieldsobject(ocsfv1.3.0softwareinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​deviceobject(ocsfv1.3.0softwareinfoDevice)

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result[].​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result[].​end_timeinteger(ocsfv1.3.0softwareinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​end_time_dtstring or null(date-time)

The end time of a time period, or the time of the most recent event included in the aggregate event.

result[].​enrichmentsArray of objects or null(ocsfv1.3.0softwareinfoEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result[].​messagestring or null

The description of the event/finding, as defined by the source.

result[].​observablesArray of objects or null(ocsfv1.3.0softwareinfoObservable)

The observables associated with the event or a finding.

result[].​osintArray of objects or null(ocsfv1.3.0softwareinfoOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result[].​raw_datastring or null

The raw event/finding data as received from the source.

result[].​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result[].​start_timeinteger(ocsfv1.3.0softwareinfoTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​start_time_dtstring or null(date-time)

The start time of a time period, or the time of the least recent event included in the aggregate event.

result[].​statusstring or null

The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

result[].​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result[].​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result[].​status_idinteger(ocsfv1.3.0softwareinfoStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Success 2 - Failure 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result[].​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result[].​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result[].​type_namestring or null

The event/finding type name, as defined by the type_uid.

result[].​unmappedobject(ocsfv1.3.0softwareinfoObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Quarantine Endpoints

Request

Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.

Bodyapplication/jsonrequired
statestring(ConnectionState)required
Enum"Connect""Disconnect"
endpoint_idsArray of stringsrequired

The list of endpoint IDs to enforce the connection state on.

commentstring or null

A comment to include with the quarantine action.

curl -i -X POST \
  https://api.synqly.com/v1/edr/endpoints/actions/quarantine \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "state": "Connect",
    "endpoint_ids": [
      "string"
    ],
    "comment": "string"
  }'

Responses

Bodyapplication/json
resultArray of stringsrequired

The list of endpoint IDs or action IDs that were successfully quarantined or unquarantined.

metaobject(MetaResponse)
Response
application/json
{ "result": [ "string" ], "meta": { "stats": {}, "api": {} } }

Query Threat Events

Request

Returns a list of threats that match the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of threats to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

include_raw_databoolean or null

Include the raw data from the EDR in the response. Defaults to false.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/threats?cursor=string&filter=string&include_raw_data=true&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objects(ocsfv1.3.0detectionfindingDetectionFinding)required

List of threats that match the query.

result[].​activity_idinteger(ocsfv1.3.0detectionfindingActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Create: A finding was created. 2 - Update: A finding was updated. 3 - Close: A finding was closed. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result[].​category_uidinteger(ocsfv1.3.0detectionfindingCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 2 - Findings: Findings events report findings, detections, and possible resolutions of malware, anomalies, or other actions performed by security products.

result[].​class_uidinteger(ocsfv1.3.0detectionfindingClassUid)required

ClassUid is an enum, and the following values are allowed. 2004 - DetectionFinding: A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the security_control profile should be applied and its attacks information should be duplicated into the finding_info object.

result[].​finding_infoobject(ocsfv1.3.0detectionfindingFindingInfo)required

The Finding Information object describes metadata related to a security finding generated by a security tool or system.

result[].​finding_info.​titlestringrequired

A title or a brief phrase summarizing the reported finding.

result[].​finding_info.​uidstringrequired

The unique identifier of the reported finding.

result[].​finding_info.​analyticobject(ocsfv1.3.0detectionfindingAnalytic)

The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.

result[].​finding_info.​attacksArray of objects or null(ocsfv1.3.0detectionfindingAttack)

The MITRE ATT&CK® technique and associated tactics related to the finding.

result[].​finding_info.​created_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​finding_info.​created_time_dtstring or null(date-time)

The time when the finding was created.

result[].​finding_info.​data_sourcesArray of strings or null

A list of data sources utilized in generation of the finding.

result[].​finding_info.​descstring or null

The description of the reported finding.

result[].​finding_info.​first_seen_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​finding_info.​first_seen_time_dtstring or null(date-time)

The time when the finding was first observed. e.g. The time when a vulnerability was first observed.

It can differ from the created_time timestamp, which reflects the time this finding was created.

result[].​finding_info.​kill_chainArray of objects or null(ocsfv1.3.0detectionfindingKillChainPhase)

The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.

result[].​finding_info.​last_seen_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​finding_info.​last_seen_time_dtstring or null(date-time)

The time when the finding was most recently observed. e.g. The time when a vulnerability was most recently observed.

It can differ from the modified_time timestamp, which reflects the time this finding was last modified.

result[].​finding_info.​modified_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​finding_info.​modified_time_dtstring or null(date-time)

The time when the finding was last modified.

result[].​finding_info.​product_uidstring or null

The unique identifier of the product that reported the finding.

result[].​finding_info.​related_analyticsArray of objects or null(ocsfv1.3.0detectionfindingAnalytic)

Other analytics related to this finding.

result[].​finding_info.​related_eventsArray of objects or null(ocsfv1.3.0detectionfindingRelatedEvent)

Describes events and/or other findings related to the finding as identified by the security product.

result[].​finding_info.​src_urlstring(ocsfv1.3.0detectionfindingURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​finding_info.​typesArray of strings or null

One or more types of the reported finding.

result[].​metadataobject(ocsfv1.3.0detectionfindingMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result[].​metadata.​productobject(ocsfv1.3.0detectionfindingProduct)required

The Product object describes characteristics of a software product.

result[].​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​metadata.​product.​featureobject(ocsfv1.3.0detectionfindingFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​metadata.​product.​namestring or null

The name of the product.

result[].​metadata.​product.​pathstring or null

The installation path of the product.

result[].​metadata.​product.​uidstring or null

The unique identifier of the product.

result[].​metadata.​product.​url_stringstring(ocsfv1.3.0detectionfindingURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result[].​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result[].​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result[].​metadata.​extensionobject(ocsfv1.3.0detectionfindingExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result[].​metadata.​extensionsArray of objects or null(ocsfv1.3.0detectionfindingExtension)

The schema extensions used to create the event.

result[].​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result[].​metadata.​log_levelstring or null

The audit level at which an event was generated.

result[].​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result[].​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result[].​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result[].​metadata.​logged_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result[].​metadata.​loggersArray of objects or null(ocsfv1.3.0detectionfindingLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result[].​metadata.​modified_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result[].​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result[].​metadata.​processed_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result[].​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result[].​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result[].​metadata.​tenant_uidstring or null

The unique tenant identifier.

result[].​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result[].​severity_idinteger(ocsfv1.3.0detectionfindingSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result[].​timeinteger(ocsfv1.3.0detectionfindingTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​type_uidinteger(ocsfv1.3.0detectionfindingTypeUid)required

TypeUid is an enum, and the following values are allowed. 200400 - Unknown 200401 - Create: A finding was created. 200402 - Update: A finding was updated. 200403 - Close: A finding was closed. 200499 - Other

result[].​actionstring or null

The normalized caption of action_id.

result[].​action_idinteger(ocsfv1.3.0detectionfindingActionId)

ActionId is an enum, and the following values are allowed. 0 - Unknown: The action was unknown. The disposition_id attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'. 1 - Allowed: The activity was allowed. The disposition_id attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc. 2 - Denied: The attempted activity was denied. The disposition_id attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc. 99 - Other: The action was not mapped. See the action attribute, which contains a data source specific value.

result[].​activity_namestring or null

The finding activity name, as defined by the activity_id.

result[].​actorobject(ocsfv1.3.0detectionfindingActor)

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

result[].​apiobject(ocsfv1.3.0detectionfindingApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result[].​attacksArray of objects or null(ocsfv1.3.0detectionfindingAttack)

An array of MITRE ATT&CK® objects describing the tactics, techniques & sub-techniques identified by a security control or finding.

result[].​authorizationsArray of objects or null(ocsfv1.3.0detectionfindingAuthorization)

Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.

result[].​category_namestring or null

The event category name, as defined by category_uid value: Findings.

result[].​cloudobject(ocsfv1.3.0detectionfindingCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result[].​commentstring or null

A user provided comment about the finding.

result[].​confidencestring or null

The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source.

result[].​confidence_idinteger(ocsfv1.3.0detectionfindingConfidenceId)

ConfidenceId is an enum, and the following values are allowed. 0 - Unknown: The normalized confidence is unknown. 1 - Low 2 - Medium 3 - High 99 - Other: The confidence is not mapped to the defined enum values. See the confidence attribute, which contains a data source specific value.

result[].​confidence_scoreinteger or null

The confidence score as reported by the event source.

result[].​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result[].​custom_fieldsobject(ocsfv1.3.0detectionfindingObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​deviceobject(ocsfv1.3.0detectionfindingDevice)

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result[].​dispositionstring or null

The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.

result[].​disposition_idinteger(ocsfv1.3.0detectionfindingDispositionId)

DispositionId is an enum, and the following values are allowed. 0 - Unknown: The disposition is unknown. 1 - Allowed: Granted access or allowed the action to the protected resource. 2 - Blocked: Denied access or blocked the action to the protected resource. 3 - Quarantined: A suspicious file or other content was moved to a benign location. 4 - Isolated: A session was isolated on the network or within a browser. 5 - Deleted: A file or other content was deleted. 6 - Dropped: The request was detected as a threat and resulted in the connection being dropped. 7 - CustomAction: A custom action was executed such as running of a command script. Use the message attribute of the base class for details. 8 - Approved: A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from 1 'Allowed'. 9 - Restored: A quarantined file or other content was restored to its original location. 10 - Exonerated: A suspicious or risky entity was deemed to no longer be suspicious (re-scored). 11 - Corrected: A corrupt file or configuration was corrected. 12 - PartiallyCorrected: A corrupt file or configuration was partially corrected. 13 - Uncorrected: A corrupt file or configuration was not corrected. 14 - Delayed: An operation was delayed, for example if a restart was required to finish the operation. 15 - Detected: Suspicious activity or a policy violation was detected without further action. 16 - NoAction: The outcome of an operation had no action taken. 17 - Logged: The operation or action was logged without further action. 18 - Tagged: A file or other entity was marked with extended attributes. 19 - Alert: The request or activity was detected as a threat and resulted in a notification but request was not blocked. 20 - Count: Counted the request or activity but did not determine whether to allow it or block it. 21 - Reset: The request was detected as a threat and resulted in the connection being reset. 22 - Captcha: Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request. 23 - Challenge: Ran a silent challenge that required the client session to verify that it's a browser, and not a bot. 24 - AccessRevoked: The requestor's access has been revoked due to security policy enforcements. Note: use the Host profile if the User or Actor requestor is not present in the event class. 25 - Rejected: A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from 2 'Blocked'. 26 - Unauthorized: An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than 2 'Blocked' and can be complemented with the authorizations attribute for more detail. 27 - Error: An error occurred during the processing of the activity or request. Use the message attribute of the base class for details. 99 - Other: The disposition is not mapped. See the disposition attribute, which contains a data source specific value.

result[].​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result[].​end_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​end_time_dtstring or null(date-time)

The time of the most recent event included in the finding.

result[].​enrichmentsArray of objects or null(ocsfv1.3.0detectionfindingEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result[].​evidencesArray of objects or null(ocsfv1.3.0detectionfindingEvidences)

Describes various evidence artifacts associated to the activity/activities that triggered a security detection.

result[].​firewall_ruleobject(ocsfv1.3.0detectionfindingFirewallRule)

The Firewall Rule object represents a specific rule within a firewall policy or event. It contains information about a rule's configuration, properties, and associated actions that define how network traffic is handled by the firewall.

result[].​impactstring or null

The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.

result[].​impact_idinteger(ocsfv1.3.0detectionfindingImpactId)

ImpactId is an enum, and the following values are allowed. 0 - Unknown: The normalized impact is unknown. 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The impact is not mapped. See the impact attribute, which contains a data source specific value.

result[].​impact_scoreinteger or null

The impact of the finding, valid range 0-100.

result[].​malwareArray of objects or null(ocsfv1.3.0detectionfindingMalware)

A list of Malware objects, describing details about the identified malware.

result[].​messagestring or null

The description of the event/finding, as defined by the source.

result[].​observablesArray of objects or null(ocsfv1.3.0detectionfindingObservable)

The observables associated with the event or a finding.

result[].​osintArray of objects or null(ocsfv1.3.0detectionfindingOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result[].​raw_datastring or null

The raw event/finding data as received from the source.

result[].​remediationobject(ocsfv1.3.0detectionfindingRemediation)

The Remediation object describes the recommended remediation steps to address identified issue(s).

result[].​resourcesArray of objects or null(ocsfv1.3.0detectionfindingResourceDetails)

Describes details about resources that were the target of the activity that triggered the finding.

result[].​risk_detailsstring or null

Describes the risk associated with the finding.

result[].​risk_levelstring or null

The risk level, normalized to the caption of the risk_level_id value.

result[].​risk_level_idinteger(ocsfv1.3.0detectionfindingRiskLevelId)

RiskLevelId is an enum, and the following values are allowed. 0 - Info 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

result[].​risk_scoreinteger or null

The risk score as reported by the event source.

result[].​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result[].​start_timeinteger(ocsfv1.3.0detectionfindingTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​start_time_dtstring or null(date-time)

The time of the least recent event included in the finding.

result[].​statusstring or null

The normalized status of the Finding set by the consumer normalized to the caption of the status_id value. In the case of 'Other', it is defined by the source.

result[].​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result[].​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result[].​status_idinteger(ocsfv1.3.0detectionfindingStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - New: The Finding is new and yet to be reviewed. 2 - InProgress: The Finding is under review. 3 - Suppressed: The Finding was reviewed, determined to be benign or a false positive and is now suppressed. 4 - Resolved: The Finding was reviewed, remediated and is now considered resolved. 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result[].​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result[].​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result[].​type_namestring or null

The event/finding type name, as defined by the type_uid.

result[].​unmappedobject(ocsfv1.3.0detectionfindingObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​vulnerabilitiesArray of objects or null(ocsfv1.3.0detectionfindingVulnerability)

Describes vulnerabilities reported in a Detection Finding.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Query Alerts

Request

Returns a list of alerts that match the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of threats to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

include_raw_databoolean or null

Include the raw data from the EDR in the response. Defaults to false.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/alerts?cursor=string&filter=string&include_raw_data=true&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of ocsfv1.3.0accountchangeAccountChange (object) or ocsfv1.3.0apiactivityApiActivity (object) or ocsfv1.3.0authenticationAuthentication (object) or ocsfv1.3.0authorizesessionAuthorizeSession (object) or ocsfv1.3.0baseeventBaseEvent (object) or ocsfv1.3.0compliancefindingComplianceFinding (object) or ocsfv1.3.0configstateConfigState (object) or ocsfv1.3.0detectionfindingDetectionFinding (object) or ocsfv1.3.0fileactivityFileActivity (object) or ocsfv1.3.0groupmanagementGroupManagement (object) or ocsfv1.3.0incidentfindingIncidentFinding (object) or ocsfv1.3.0inventoryinfoInventoryInfo (object) or ocsfv1.3.0moduleactivityModuleActivity (object) or ocsfv1.3.0networkactivityNetworkActivity (object) or ocsfv1.3.0processactivityProcessActivity (object) or ocsfv1.3.0scanactivityScanActivity (object) or ocsfv1.3.0scheduledjobactivityScheduledJobActivity (object) or ocsfv1.3.0securityfindingSecurityFinding (object) or ocsfv1.3.0softwareinfoSoftwareInfo (object) or ocsfv1.3.0useraccessmanagementUserAccess (object) or ocsfv1.3.0vulnerabilityfindingVulnerabilityFinding (object) or ocsfv1.3.0webresourceaccessactivityWebResourceAccessActivity (object)(Event)required

List of alerts that match the query.

One of:

Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked.

result[].​class_namestringrequired
Value"Account Change"
result[].​activity_idinteger(ocsfv1.3.0accountchangeActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Create: A user/role was created. 2 - Enable: A user/role was enabled. 3 - PasswordChange: An attempt was made to change an account's password. 4 - PasswordReset: An attempt was made to reset an account's password. 5 - Disable: A user/role was disabled. 6 - Delete: A user/role was deleted. 7 - AttachPolicy: An IAM Policy was attached to a user/role. 8 - DetachPolicy: An IAM Policy was detached from a user/role. 9 - Lock: A user account was locked out. 10 - MFAFactorEnable: An authentication factor was enabled for an account. 11 - MFAFactorDisable: An authentication factor was disabled for an account. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result[].​category_uidinteger(ocsfv1.3.0accountchangeCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 3 - AccessManagement: Identity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc.

result[].​class_uidinteger(ocsfv1.3.0accountchangeClassUid)required

ClassUid is an enum, and the following values are allowed. 3001 - AccountChange: Account Change events report when specific user account management tasks are performed, such as a user/role being created, changed, deleted, renamed, disabled, enabled, locked out or unlocked.

result[].​metadataobject(ocsfv1.3.0accountchangeMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result[].​metadata.​productobject(ocsfv1.3.0accountchangeProduct)required

The Product object describes characteristics of a software product.

result[].​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​metadata.​product.​featureobject(ocsfv1.3.0accountchangeFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​metadata.​product.​namestring or null

The name of the product.

result[].​metadata.​product.​pathstring or null

The installation path of the product.

result[].​metadata.​product.​uidstring or null

The unique identifier of the product.

result[].​metadata.​product.​url_stringstring(ocsfv1.3.0accountchangeURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result[].​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result[].​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result[].​metadata.​extensionobject(ocsfv1.3.0accountchangeExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result[].​metadata.​extensionsArray of objects or null(ocsfv1.3.0accountchangeExtension)

The schema extensions used to create the event.

result[].​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result[].​metadata.​log_levelstring or null

The audit level at which an event was generated.

result[].​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result[].​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result[].​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result[].​metadata.​logged_timeinteger(ocsfv1.3.0accountchangeTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result[].​metadata.​loggersArray of objects or null(ocsfv1.3.0accountchangeLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result[].​metadata.​modified_timeinteger(ocsfv1.3.0accountchangeTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result[].​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result[].​metadata.​processed_timeinteger(ocsfv1.3.0accountchangeTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result[].​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result[].​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result[].​metadata.​tenant_uidstring or null

The unique tenant identifier.

result[].​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result[].​severity_idinteger(ocsfv1.3.0accountchangeSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result[].​timeinteger(ocsfv1.3.0accountchangeTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​type_uidinteger(ocsfv1.3.0accountchangeTypeUid)required

TypeUid is an enum, and the following values are allowed. 300100 - Unknown 300101 - Create: A user/role was created. 300102 - Enable: A user/role was enabled. 300103 - PasswordChange: An attempt was made to change an account's password. 300104 - PasswordReset: An attempt was made to reset an account's password. 300105 - Disable: A user/role was disabled. 300106 - Delete: A user/role was deleted. 300107 - AttachPolicy: An IAM Policy was attached to a user/role. 300108 - DetachPolicy: An IAM Policy was detached from a user/role. 300109 - Lock: A user account was locked out. 300110 - MFAFactorEnable: An authentication factor was enabled for an account. 300111 - MFAFactorDisable: An authentication factor was disabled for an account. 300199 - Other

result[].​userobject(ocsfv1.3.0accountchangeUser)required

The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND d3f:UserAccount.

result[].​user.​accountobject(ocsfv1.3.0accountchangeAccount)

The Account object contains details about the account that initiated or performed a specific activity within a system or application.

result[].​user.​credential_uidstring or null

The unique identifier of the user's credential. For example, AWS Access Key ID.

result[].​user.​domainstring or null

The domain where the user is defined. For example: the LDAP or Active Directory domain.

result[].​user.​email_addrstring(ocsfv1.3.0accountchangeEmailAddress)

Email address. For example: john_doe@example.com.

result[].​user.​full_namestring or null

The full name of the person, as per the LDAP Common Name attribute (cn).

result[].​user.​groupsArray of objects or null(ocsfv1.3.0accountchangeGroup)

The administrative groups to which the user belongs.

result[].​user.​ldap_personobject(ocsfv1.3.0accountchangeLdapPerson)

The additional LDAP attributes that describe a person.

result[].​user.​mfa_statusstring or null

The multi-factor authentication status, normalized to the caption of the mfa_status_id value. In the case of 'Other', it is defined by the data source.

result[].​user.​mfa_status_idinteger(ocsfv1.3.0accountchangeUser_MfaStatusId)

UserMfaStatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Enabled: Multi-factor authentication is on for this user. 2 - NotEnabled: TMulti-factor authentication is off for this user. 99 - Other: The event status is not mapped. See the user_status attribute, which contains a data source specific value.

result[].​user.​namestring(ocsfv1.3.0accountchangeUserName)

User name. For example: john_doe.

result[].​user.​orgobject(ocsfv1.3.0accountchangeOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result[].​user.​privilegesArray of strings or null

The user's privileges.

result[].​user.​risk_levelstring or null

The risk level, normalized to the caption of the risk_level_id value.

result[].​user.​risk_level_idinteger(ocsfv1.3.0accountchangeUser_RiskLevelId)

UserRiskLevelId is an enum, and the following values are allowed. 0 - Info 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

result[].​user.​risk_scoreinteger or null

The risk score as reported by the event source.

result[].​user.​typestring or null

The type of the user. For example, System, AWS IAM User, etc.

result[].​user.​type_idinteger(ocsfv1.3.0accountchangeUser_TypeId)

UserTypeId is an enum, and the following values are allowed. 0 - Unknown: The type is unknown. 1 - User: Regular user account. 2 - Admin: Admin/root user account. 3 - System: System account. For example, Windows computer accounts with a trailing dollar sign ($). 99 - Other: The type is not mapped. See the type attribute, which contains a data source specific value.

result[].​user.​uidstring or null

The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN.

result[].​user.​uid_altstring or null

The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID.

result[].​user.​user_statusstring or null

The user status, normalized to the caption of the user_status_id value. In the case of 'Other', it is defined by the data source.

result[].​user.​user_status_idinteger(ocsfv1.3.0accountchangeUser_UserStatusId)

UserUserStatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Active: The user is active. 2 - Pending: The user is not active, pending either user or admin action. 3 - Locked: The user account is locked requiring either time or intervention to unlock. 4 - Suspended: The user account is suspended. 5 - Deprovisioned: The user account has been deprovisioned and is pending removal. 99 - Other: The event status is not mapped. See the user_status attribute, which contains a data source specific value.

result[].​activity_namestring or null

The event activity name, as defined by the activity_id.

result[].​actorobject(ocsfv1.3.0accountchangeActor)

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

result[].​apiobject(ocsfv1.3.0accountchangeApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result[].​category_namestring or null

The event category name, as defined by category_uid value: Identity & Access Management.

result[].​cloudobject(ocsfv1.3.0accountchangeCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result[].​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result[].​custom_fieldsobject(ocsfv1.3.0accountchangeObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​deviceobject(ocsfv1.3.0accountchangeDevice)

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result[].​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result[].​end_timeinteger(ocsfv1.3.0accountchangeTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​end_time_dtstring or null(date-time)

The end time of a time period, or the time of the most recent event included in the aggregate event.

result[].​enrichmentsArray of objects or null(ocsfv1.3.0accountchangeEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result[].​http_requestobject(ocsfv1.3.0accountchangeHttpRequest)

The HTTP Request object represents the attributes of a request made to a web server. It encapsulates the details and metadata associated with an HTTP request, including the request method, headers, URL, query parameters, body content, and other relevant information.

result[].​messagestring or null

The description of the event/finding, as defined by the source.

result[].​observablesArray of objects or null(ocsfv1.3.0accountchangeObservable)

The observables associated with the event or a finding.

result[].​osintArray of objects or null(ocsfv1.3.0accountchangeOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result[].​policyobject(ocsfv1.3.0accountchangePolicy)

The Policy object describes the policies that are applicable.

Policy attributes provide traceability to the operational state of the security product at the time that the event was captured, facilitating forensics, troubleshooting, and policy tuning/adjustments.

result[].​raw_datastring or null

The raw event/finding data as received from the source.

result[].​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result[].​src_endpointobject(ocsfv1.3.0accountchangeNetworkEndpoint)

The Network Endpoint object describes characteristics of a network endpoint. These can be a source or destination of a network connection.

result[].​start_timeinteger(ocsfv1.3.0accountchangeTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​start_time_dtstring or null(date-time)

The start time of a time period, or the time of the least recent event included in the aggregate event.

result[].​statusstring or null

The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

result[].​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result[].​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result[].​status_idinteger(ocsfv1.3.0accountchangeStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Success 2 - Failure 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result[].​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result[].​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result[].​type_namestring or null

The event/finding type name, as defined by the type_uid.

result[].​unmappedobject(ocsfv1.3.0accountchangeObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​user_resultobject(ocsfv1.3.0accountchangeUser)

The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND d3f:UserAccount.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Query IOCs

Request

Returns a list of iocs that match the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of threats to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

include_raw_databoolean or null

Include the raw data from the EDR in the response. Defaults to false.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/iocs?cursor=string&filter=string&include_raw_data=true&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objects(stixIndicator)required

List of iocs that match the query.

result[].​typestringrequired
Value "indicator"
result[].​valid_fromstring(date-time)required

The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.

result[].​spec_versionstringrequired
Value "2.1"
result[].​idstring(stixId)required
result[].​createdstring(date-time)required

The created property represents the time at which the object was originally created.

result[].​modifiedstring(date-time)required

The modified property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified.

result[].​namestring or null

A name used to identify the Indicator.

result[].​descriptionstring or null

A description that provides more details and context about the Indicator, potentially including its purpose and its key characteristics.

result[].​indicator_typesArray of strings or null(stixindicator_type_ov)

A set of categorizations for this indicator.

Enum"anomalous_activity""anonymization""benign""compromised""malicious_activity""attribution""unknown"
result[].​patternstring or null

The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc.

result[].​pattern_typestring(stixpattern_type_ov)

covers common pattern languages

Enum"stix""pcre""sigma""snort""suricata""yara"
result[].​pattern_versionstring or null

The version of the pattern expression used in the pattern property.

result[].​valid_untilstring or null(date-time)

The time at which this Indicator is no longer considered valid.

result[].​kill_chain_phasesArray of objects or null(stixKillChainPhase)

The kill chain phase to which this Indicator corresponds.

result[].​raw_datastring or null

The data as received from the source.

result[].​created_by_refobject(stixIdentity)Recursive
result[].​revokedboolean or null

The revoked property indicates whether this object has been revoked. If the revoked property is present and set to true, then the object has been revoked.

result[].​labelsArray of strings or null

The labels property is an array of strings that are used to categorize this object.

result[].​confidenceinteger or null

The confidence property is an integer from 0 to 100 that represents the confidence that this object is accurate and valid.

result[].​langstring or null

The lang property specifies the language used in the properties of the object.

result[].​external_referencesArray of objects or null(stixExternalReference)

The external_references property is an array of external references that are relevant to this object.

result[].​object_marking_refsArray of objects or null(stixMarkingDefinition)

The object_marking_refs property is an array of ids of marking_definition objects that apply to this object.

result[].​granular_markingsArray of objects or null(stixGranularMarking)

The granular_markings property is an array of granular markings that are applied to this object.

result[].​extensionsobject or null

The extensions property is an object that contains custom properties or objects that extend the object.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Create IOCs

Request

Creates a list of iocs that match the stix input for the EDR source.

Bodyapplication/jsonrequired
indicatorsArray of objects(stixIndicator)required

The list of iocs to create

indicators[].​typestringrequired
Value "indicator"
indicators[].​valid_fromstring(date-time)required

The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.

indicators[].​spec_versionstringrequired
Value "2.1"
indicators[].​idstring(stixId)required
indicators[].​createdstring(date-time)required

The created property represents the time at which the object was originally created.

indicators[].​modifiedstring(date-time)required

The modified property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified.

indicators[].​namestring or null

A name used to identify the Indicator.

indicators[].​descriptionstring or null

A description that provides more details and context about the Indicator, potentially including its purpose and its key characteristics.

indicators[].​indicator_typesArray of strings or null(stixindicator_type_ov)

A set of categorizations for this indicator.

Enum"anomalous_activity""anonymization""benign""compromised""malicious_activity""attribution""unknown"
indicators[].​patternstring or null

The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc.

indicators[].​pattern_typestring(stixpattern_type_ov)

covers common pattern languages

Enum"stix""pcre""sigma""snort""suricata""yara"
indicators[].​pattern_versionstring or null

The version of the pattern expression used in the pattern property.

indicators[].​valid_untilstring or null(date-time)

The time at which this Indicator is no longer considered valid.

indicators[].​kill_chain_phasesArray of objects or null(stixKillChainPhase)

The kill chain phase to which this Indicator corresponds.

indicators[].​raw_datastring or null

The data as received from the source.

indicators[].​created_by_refobject(stixIdentity)Recursive
indicators[].​revokedboolean or null

The revoked property indicates whether this object has been revoked. If the revoked property is present and set to true, then the object has been revoked.

indicators[].​labelsArray of strings or null

The labels property is an array of strings that are used to categorize this object.

indicators[].​confidenceinteger or null

The confidence property is an integer from 0 to 100 that represents the confidence that this object is accurate and valid.

indicators[].​langstring or null

The lang property specifies the language used in the properties of the object.

indicators[].​external_referencesArray of objects or null(stixExternalReference)

The external_references property is an array of external references that are relevant to this object.

indicators[].​object_marking_refsArray of objects or null(stixMarkingDefinition)

The object_marking_refs property is an array of ids of marking_definition objects that apply to this object.

indicators[].​granular_markingsArray of objects or null(stixGranularMarking)

The granular_markings property is an array of granular markings that are applied to this object.

indicators[].​extensionsobject or null

The extensions property is an object that contains custom properties or objects that extend the object.

curl -i -X POST \
  https://api.synqly.com/v1/edr/iocs \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "indicators": [
      {
        "type": "indicator",
        "name": "string",
        "description": "string",
        "indicator_types": [
          "anomalous_activity"
        ],
        "pattern": "string",
        "pattern_type": "stix",
        "pattern_version": "string",
        "valid_from": "2019-08-24T14:15:22Z",
        "valid_until": "2019-08-24T14:15:22Z",
        "kill_chain_phases": [
          {
            "kill_chain_name": "string",
            "phase_name": "string"
          }
        ],
        "raw_data": "string",
        "spec_version": "2.1",
        "id": "string",
        "created_by_ref": {
          "type": "string",
          "name": "string",
          "description": "string",
          "roles": "string",
          "identity_class": "individual"
        },
        "created": "2019-08-24T14:15:22Z",
        "modified": "2019-08-24T14:15:22Z",
        "revoked": true,
        "labels": [
          "string"
        ],
        "confidence": 0,
        "lang": "string",
        "external_references": [
          {
            "source_name": "string",
            "description": "string",
            "url": "string",
            "hash": "string",
            "external_id": "string"
          }
        ],
        "object_marking_refs": [
          {
            "type": "string",
            "name": "string"
          }
        ],
        "granular_markings": [
          {
            "lang": "string",
            "marking_ref": {
              "type": "string",
              "name": "string"
            },
            "selectors": [
              "string"
            ]
          }
        ],
        "extensions": {}
      }
    ]
  }'

Responses

Bodyapplication/json
resultArray of objects(stixIndicator)required

A list of the indicators that were created

result[].​typestringrequired
Value "indicator"
result[].​valid_fromstring(date-time)required

The time from which this Indicator is considered a valid indicator of the behaviors it is related or represents.

result[].​spec_versionstringrequired
Value "2.1"
result[].​idstring(stixId)required
result[].​createdstring(date-time)required

The created property represents the time at which the object was originally created.

result[].​modifiedstring(date-time)required

The modified property is only used by STIX Objects that support versioning and represents the time that this particular version of the object was last modified.

result[].​namestring or null

A name used to identify the Indicator.

result[].​descriptionstring or null

A description that provides more details and context about the Indicator, potentially including its purpose and its key characteristics.

result[].​indicator_typesArray of strings or null(stixindicator_type_ov)

A set of categorizations for this indicator.

Enum"anomalous_activity""anonymization""benign""compromised""malicious_activity""attribution""unknown"
result[].​patternstring or null

The detection pattern for this Indicator MAY be expressed as a STIX Pattern as specified in section 9 or another appropriate language such as SNORT, YARA, etc.

result[].​pattern_typestring(stixpattern_type_ov)

covers common pattern languages

Enum"stix""pcre""sigma""snort""suricata""yara"
result[].​pattern_versionstring or null

The version of the pattern expression used in the pattern property.

result[].​valid_untilstring or null(date-time)

The time at which this Indicator is no longer considered valid.

result[].​kill_chain_phasesArray of objects or null(stixKillChainPhase)

The kill chain phase to which this Indicator corresponds.

result[].​raw_datastring or null

The data as received from the source.

result[].​created_by_refobject(stixIdentity)Recursive
result[].​revokedboolean or null

The revoked property indicates whether this object has been revoked. If the revoked property is present and set to true, then the object has been revoked.

result[].​labelsArray of strings or null

The labels property is an array of strings that are used to categorize this object.

result[].​confidenceinteger or null

The confidence property is an integer from 0 to 100 that represents the confidence that this object is accurate and valid.

result[].​langstring or null

The lang property specifies the language used in the properties of the object.

result[].​external_referencesArray of objects or null(stixExternalReference)

The external_references property is an array of external references that are relevant to this object.

result[].​object_marking_refsArray of objects or null(stixMarkingDefinition)

The object_marking_refs property is an array of ids of marking_definition objects that apply to this object.

result[].​granular_markingsArray of objects or null(stixGranularMarking)

The granular_markings property is an array of granular markings that are applied to this object.

result[].​extensionsobject or null

The extensions property is an object that contains custom properties or objects that extend the object.

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "meta": { "stats": {}, "api": {} } }

Delete IOCs

Request

Deletes a list of iocs that match the input of ids in the query param

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

idsstring or null

list of ids to delete

curl -i -X DELETE \
  'https://api.synqly.com/v1/edr/iocs?ids=string&meta=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of stringsrequired

A list of ids of the iocs that were deleted.

metaobject(MetaResponse)
Response
application/json
{ "result": [ "string" ], "meta": { "stats": {}, "api": {} } }

Query Posture Score

Request

Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.

Query
metaArray of strings or null

Add metadata to the response by invoking meta functions. Documentation for meta functions is available at https://docs.synqly.com/api-reference/meta-functions. Not all meta function are available at every endpoint.

limitinteger or null

Number of scores for endpoints to return. Defaults to 50.

cursorstring or null

Start search from cursor position.

orderArray of strings or null

Select a field to order the results by. Defaults to name. To control the direction of the sorting, append [asc] or [desc] to the field name. For example, name[asc] will sort the results by name in ascending order. The ordering defaults to asc if not specified.

filterArray of strings or null

Filter results by this query. For more information on filtering, refer to our Filtering Guide. Defaults to no filter. If used more than once, the queries are ANDed together.

include_raw_databoolean or null

Include the raw data from the EDR in the response. Defaults to false.

curl -i -X GET \
  'https://api.synqly.com/v1/edr/posture_score?cursor=string&filter=string&include_raw_data=true&limit=0&meta=string&order=string' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Bodyapplication/json
resultArray of objects(ocsfv1.3.0configstateConfigState)required

List of posture scores that match the query.

result[].​activity_idinteger(ocsfv1.3.0configstateActivityId)required

ActivityId is an enum, and the following values are allowed. 0 - Unknown: The event activity is unknown. 1 - Log: The discovered information is via a log. 2 - Collect: The discovered information is via a collection process. 99 - Other: The event activity is not mapped. See the activity_name attribute, which contains a data source specific value.

result[].​category_uidinteger(ocsfv1.3.0configstateCategoryUid)required

CategoryUid is an enum, and the following values are allowed. 5 - Discovery: Discovery events report the existence and state of devices, files, configurations, processes, registry keys, and other objects.

result[].​class_uidinteger(ocsfv1.3.0configstateClassUid)required

ClassUid is an enum, and the following values are allowed. 5002 - DeviceConfigState: Device Config State events report device configuration data and CIS Benchmark results.

result[].​deviceobject(ocsfv1.3.0configstateDevice)required

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network. Defined by D3FEND d3f:Host.

result[].​device.​type_idinteger(ocsfv1.3.0configstateDevice_TypeId)required
result[].​device.​agent_listArray of objects or null(ocsfv1.3.0configstateAgent)

A list of agent objects associated with a device, endpoint, or resource.

result[].​device.​autoscale_uidstring or null

The unique identifier of the cloud autoscale configuration.

result[].​device.​boot_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​boot_time_dtstring or null(date-time)

The time the system was booted.

result[].​device.​containerobject(ocsfv1.3.0configstateContainer)

The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

result[].​device.​created_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​created_time_dtstring or null(date-time)

The time when the device was known to have been created.

result[].​device.​descstring or null

The description of the device, ordinarily as reported by the operating system.

result[].​device.​domainstring or null

The network domain where the device resides. For example: work.example.com.

result[].​device.​first_seen_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​first_seen_time_dtstring or null(date-time)

The initial discovery time of the device.

result[].​device.​groupsArray of objects or null(ocsfv1.3.0configstateGroup)

The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"].

result[].​device.​hostnamestring(ocsfv1.3.0configstateHostname)

Unique name assigned to a device connected to a computer network. A domain name in general is an Internet address that can be resolved through the Domain Name System (DNS). For example: r2-d2.example.com.

result[].​device.​hw_infoobject(ocsfv1.3.0configstateDeviceHwInfo)

The Device Hardware Information object contains details and specifications of the physical components that make up a device. This information provides an overview of the hardware capabilities, configuration, and characteristics of the device.

result[].​device.​hypervisorstring or null

The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.

result[].​device.​imageobject(ocsfv1.3.0configstateImage)

The Image object provides a description of a specific Virtual Machine (VM) or Container image. Defined by D3FEND d3f:ContainerImage.

result[].​device.​imeistring or null

The International Mobile Station Equipment Identifier that is associated with the device.

result[].​device.​instance_uidstring or null

The unique identifier of a VM instance.

result[].​device.​interface_namestring or null

The name of the network interface (e.g. eth2).

result[].​device.​interface_uidstring or null

The unique identifier of the network interface.

result[].​device.​ipstring(ocsfv1.3.0configstateIPAddress)

Internet Protocol address (IP address), in either IPv4 or IPv6 format. For example, 192.168.200.24 or 2001:0db8:85a3:0000:0000:8a2e:0370:7334.

result[].​device.​ip_addressesArray of strings or null

A list of IP addresses available on the device

result[].​device.​is_compliantboolean or null

The event occurred on a compliant device.

result[].​device.​is_managedboolean or null

The event occurred on a managed device.

result[].​device.​is_personalboolean or null

The event occurred on a personal device.

result[].​device.​is_trustedboolean or null

The event occurred on a trusted device.

result[].​device.​last_seen_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​last_seen_time_dtstring or null(date-time)

The most recent discovery time of the device.

result[].​device.​locationobject(ocsfv1.3.0configstateLocation)

The Geo Location object describes a geographical location, usually associated with an IP address. Defined by D3FEND d3f:PhysicalLocation.

result[].​device.​macstring(ocsfv1.3.0configstateMACAddress)

Media Access Control (MAC) address. For example: 18:36:F3:98:4F:9A.

result[].​device.​mac_addressesArray of strings or null

A list of MAC addresses available on the device

result[].​device.​modified_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​device.​modified_time_dtstring or null(date-time)

The time when the device was last known to have been modified.

result[].​device.​namestring or null

The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

result[].​device.​namespace_pidinteger or null

If running under a process namespace (such as in a container), the process identifier within that process namespace.

result[].​device.​netbios_namesArray of strings or null

A list of NetBIOS names available on the device

result[].​device.​network_interfacesArray of objects or null(ocsfv1.3.0configstateNetworkInterface)

The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

result[].​device.​network_statusstring or null

The network isolation status of the endpoiint

result[].​device.​network_status_idinteger(ocsfv1.3.0configstateDevice_NetworkStatusId)

DeviceNetworkStatusId is an enum, and the following values are allowed. 1 - NotIsolated: Device is not isolated from the network. 2 - Isolated: Device is isolated from the network. 99 - Unknown: The network isolation status is unknown.

result[].​device.​orgobject(ocsfv1.3.0configstateOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result[].​device.​osobject(ocsfv1.3.0configstateOs)

The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows. Defined by D3FEND d3f:OperatingSystem.

result[].​device.​ownerobject(ocsfv1.3.0configstateUser)

The User object describes the characteristics of a user/person or a security principal. Defined by D3FEND d3f:UserAccount.

result[].​device.​regionstring or null

The region where the virtual machine is located. For example, an AWS Region.

result[].​device.​risk_levelstring or null

The risk level, normalized to the caption of the risk_level_id value.

result[].​device.​risk_level_idinteger(ocsfv1.3.0configstateDevice_RiskLevelId)

DeviceRiskLevelId is an enum, and the following values are allowed. 0 - Info 1 - Low 2 - Medium 3 - High 4 - Critical 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

result[].​device.​risk_scoreinteger or null

The risk score as reported by the event source.

result[].​device.​subnetstring(ocsfv1.3.0configstateSubnet)

The subnet represented in a CIDR notation, using the format network_address/prefix_length. The network_address can be in either IPv4 or IPv6 format. The prefix length indicates the number of bits used for the network portion, and the remaining bits are available for host addresses within that subnet.

For example:
  • 192.168.1.0/24
  • 2001:0db8:85a3:0000::/64

result[].​device.​subnet_uidstring or null

The unique identifier of a virtual subnet.

result[].​device.​sw_infoArray of objects or null(ocsfv1.3.0configstateProduct)

The list of software contained on a device

result[].​device.​typestring or null

The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, plc, scada, dcs, cnc, scientific, medical, lighting, energy, transportation other.

result[].​device.​uidstring or null

The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.

result[].​device.​uid_altstring or null

An alternate unique identifier of the device if any. For example the ActiveDirectory DN.

result[].​device.​vendorobject(ocsfv1.3.0configstateOrganization)

The Organization object describes characteristics of an organization or company and its division if any.

result[].​device.​vlan_uidstring or null

The Virtual LAN identifier.

result[].​device.​vpc_uidstring or null

The unique identifier of the Virtual Private Cloud (VPC).

result[].​device.​zonestring or null

The network zone or LAN segment.

result[].​metadataobject(ocsfv1.3.0configstateMetadata)required

The Metadata object describes the metadata associated with the event. Defined by D3FEND d3f:Metadata.

result[].​metadata.​productobject(ocsfv1.3.0configstateProduct)required

The Product object describes characteristics of a software product.

result[].​metadata.​product.​vendor_namestringrequired

The name of the vendor of the product.

result[].​metadata.​product.​cpe_namestring or null

The Common Platform Enumeration (CPE) name as described by (NIST) For example: cpe:/a:apple:safari:16.2.

result[].​metadata.​product.​featureobject(ocsfv1.3.0configstateFeature)

The Feature object provides information about the software product feature that generated a specific event. It encompasses details related to the capabilities, components, user interface (UI) design, and performance upgrades associated with the feature.

result[].​metadata.​product.​langstring or null

The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).

result[].​metadata.​product.​namestring or null

The name of the product.

result[].​metadata.​product.​pathstring or null

The installation path of the product.

result[].​metadata.​product.​uidstring or null

The unique identifier of the product.

result[].​metadata.​product.​url_stringstring(ocsfv1.3.0configstateURLString)

Uniform Resource Locator (URL) string. For example: http://www.example.com/download/trouble.exe.

result[].​metadata.​product.​versionstring or null

The version of the product, as defined by the event source. For example: 2013.1.3-beta.

result[].​metadata.​versionstringrequired

The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.

result[].​metadata.​correlation_uidstring or null

The unique identifier used to correlate events.

result[].​metadata.​event_codestring or null

The Event ID or Code that the product uses to describe the event.

result[].​metadata.​extensionobject(ocsfv1.3.0configstateExtension)

The OCSF Schema Extension object provides detailed information about the schema extension used to construct the event. The schema extensions are registered in the extensions.md file.

result[].​metadata.​extensionsArray of objects or null(ocsfv1.3.0configstateExtension)

The schema extensions used to create the event.

result[].​metadata.​labelsArray of strings or null

The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.

For example: ["network", "connection.ip:destination", "device.ip:source"]
result[].​metadata.​log_levelstring or null

The audit level at which an event was generated.

result[].​metadata.​log_namestring or null

The event log name. For example, syslog file name or Windows logging subsystem: Security.

result[].​metadata.​log_providerstring or null

The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing.

result[].​metadata.​log_versionstring or null

The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version.

result[].​metadata.​logged_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​logged_time_dtstring or null(date-time)

The time when the logging system collected and logged the event.

This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
result[].​metadata.​loggersArray of objects or null(ocsfv1.3.0configstateLogger)

An array of Logger objects that describe the devices and logging products between the event source and its eventual destination. Note, this attribute can be used when there is a complex end-to-end path of event flow.

result[].​metadata.​modified_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​modified_time_dtstring or null(date-time)

The time when the event was last modified or enriched.

result[].​metadata.​original_timestring or null

The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.

result[].​metadata.​processed_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​metadata.​processed_time_dtstring or null(date-time)

The event processed time, such as an ETL operation.

result[].​metadata.​profilesArray of strings or null

The list of profiles used to create the event. Profiles should be referenced by their name attribute for core profiles, or extension/name for profiles from extensions.

result[].​metadata.​sequenceinteger or null

Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision.

result[].​metadata.​tenant_uidstring or null

The unique tenant identifier.

result[].​metadata.​uidstring or null

The logging system-assigned unique identifier of an event instance.

result[].​severity_idinteger(ocsfv1.3.0configstateSeverityId)required

SeverityId is an enum, and the following values are allowed. 0 - Unknown: The event/finding severity is unknown. 1 - Informational: Informational message. No action required. 2 - Low: The user decides if action is needed. 3 - Medium: Action is required but the situation is not serious at this time. 4 - High: Action is required immediately. 5 - Critical: Action is required immediately and the scope is broad. 6 - Fatal: An error occurred but it is too late to take remedial action. 99 - Other: The event/finding severity is not mapped. See the severity attribute, which contains a data source specific value.

result[].​timeinteger(ocsfv1.3.0configstateTimestamp)required

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​type_uidinteger(ocsfv1.3.0configstateTypeUid)required

TypeUid is an enum, and the following values are allowed. 500200 - Unknown 500201 - Log: The discovered information is via a log. 500202 - Collect: The discovered information is via a collection process. 500299 - Other

result[].​activity_namestring or null

The event activity name, as defined by the activity_id.

result[].​actorobject(ocsfv1.3.0configstateActor)

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

result[].​apiobject(ocsfv1.3.0configstateApi)

The API, or Application Programming Interface, object represents information pertaining to an API request and response.

result[].​category_namestring or null

The event category name, as defined by category_uid value: Discovery.

result[].​cis_benchmark_resultobject(ocsfv1.3.0configstateCisBenchmarkResult)

The CIS Benchmark Result object contains information as defined by the Center for Internet Security (CIS) benchmark result. CIS Benchmarks are a collection of best practices for securely configuring IT systems, software, networks, and cloud infrastructure.

result[].​cloudobject(ocsfv1.3.0configstateCloud)

The Cloud object contains information about a cloud account such as AWS Account ID, regions, etc.

result[].​countinteger or null

The number of times that events in the same logical group occurred during the event Start Time to End Time period.

result[].​custom_fieldsobject(ocsfv1.3.0configstateObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

result[].​durationinteger or null

The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.

result[].​end_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​end_time_dtstring or null(date-time)

The end time of a time period, or the time of the most recent event included in the aggregate event.

result[].​enrichmentsArray of objects or null(ocsfv1.3.0configstateEnrichment)

The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:

[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

result[].​messagestring or null

The description of the event/finding, as defined by the source.

result[].​observablesArray of objects or null(ocsfv1.3.0configstateObservable)

The observables associated with the event or a finding.

result[].​osintArray of objects or null(ocsfv1.3.0configstateOsint)

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

result[].​raw_datastring or null

The raw event/finding data as received from the source.

result[].​severitystring or null

The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.

result[].​start_timeinteger(ocsfv1.3.0configstateTimestamp)

The timestamp format is the number of milliseconds since the Epoch 01/01/1970 00:00:00 UTC. For example 1618524549901.

result[].​start_time_dtstring or null(date-time)

The start time of a time period, or the time of the least recent event included in the aggregate event.

result[].​statusstring or null

The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.

result[].​status_codestring or null

The event status code, as reported by the event source.

For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.

result[].​status_detailstring or null

The status detail contains additional information about the event/finding outcome.

result[].​status_idinteger(ocsfv1.3.0configstateStatusId)

StatusId is an enum, and the following values are allowed. 0 - Unknown: The status is unknown. 1 - Success 2 - Failure 99 - Other: The event status is not mapped. See the status attribute, which contains a data source specific value.

result[].​time_dtstring or null(date-time)

The normalized event occurrence time or the finding creation time.

result[].​timezone_offsetinteger or null

The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.

result[].​type_namestring or null

The event/finding type name, as defined by the type_uid.

result[].​unmappedobject(ocsfv1.3.0configstateObject)

An unordered collection of attributes. It defines a set of attributes available in all objects. It can be also used as a generic object to log objects that are not otherwise defined by the schema.

cursorstringrequired

Cursor to use to retrieve the next page of results

metaobject(MetaResponse)
Response
application/json
{ "result": [ {} ], "cursor": "string", "meta": { "stats": {}, "api": {} } }

Hooks

Operations

Identity

Operations

Notifications

Operations

Operations (In Development)

In Development

This feature is actively being developed. Breaking changes should be expected.

Please contact us before using this feature.

Operations

Siem

Operations

Sink

Operations

Storage

Operations

Ticketing

Operations

Vulnerabilities

Operations