REST API documentation

Fetch all alert types

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns a collection of all possible alert types

application/json

get

/alerts/types

HTTPcURLJavaScriptPython

GET /alerts/types HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns a collection of all possible alert types

[
  {
    "id": 1,
    "name": "text"
  }
]

Update password for default user

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

newPasswordstring · min: 5 · max: 20000Required

Responses

204

Password updated successfully

400

Will be returned if body is not correct

application/json

500

Will be returned if there was error with parsing configuration file

put

/authentication/password

HTTPcURLJavaScriptPython

PUT /authentication/password HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 22

{
  "newPassword": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

No content

Get all excluded paths

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns array of excluded paths

text/plainapplication/jsontext/json

404

Excluded paths file not found

text/plainapplication/jsontext/json

get

/settings/excluded-paths

HTTPcURLJavaScriptPython

GET /settings/excluded-paths HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "path": "text",
      "user": "text"
    }
  ]
}

Create new excluded path

post

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

pathstring · min: 1Required

userstring | nullableOptional

Responses

201

Returns single excluded path

text/plainapplication/jsontext/json

400

Bad request was sent

text/plainapplication/jsontext/json

404

Excluded paths file not found

text/plainapplication/jsontext/json

409

Excluded path already exists

text/plainapplication/jsontext/json

post

/settings/excluded-paths

HTTPcURLJavaScriptPython

POST /settings/excluded-paths HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 29

{
  "path": "text",
  "user": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Get single excluded path

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Path parameters

idstring · uuidRequired

Responses

200

Returns single excluded path

text/plainapplication/jsontext/json

404

Excluded path not found or excluded paths file not found

text/plainapplication/jsontext/json

get

/settings/excluded-paths/{id}

HTTPcURLJavaScriptPython

GET /settings/excluded-paths/{id} HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Remove excluded path

delete

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Path parameters

idstring · uuidRequired

Responses

204

Excluded path was removed

404

Excluded paths file not found

text/plainapplication/jsontext/json

delete

/settings/excluded-paths/{id}

HTTPcURLJavaScriptPython

DELETE /settings/excluded-paths/{id} HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

No content

Fetch all file system event types

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns a collection of all possible file system event types

application/json

get

/events/types

HTTPcURLJavaScriptPython

GET /events/types HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns a collection of all possible file system event types

[
  {
    "id": 1,
    "name": "text"
  }
]

Fetch file system events from database

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Query parameters

Startstring · date-timeOptional

Endstring · date-timeOptional

Limitinteger · int32 · min: 1 · max: 5000Optional

CursorstringOptional

incidentstring · uuidOptional

Responses

200

Returns a response object containing the collection of file system events

application/json

400

Will be returned if request is not valid

application/json

404

Incident with provided id was not found

application/json

get

/events

HTTPcURLJavaScriptPython

GET /events HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2025-12-14T18:34:11.985Z",
      "insertionTimeStamp": "2025-12-14T18:34:11.985Z",
      "type": {
        "id": 1,
        "name": "text"
      },
      "username": "text",
      "pid": 1,
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text",
  "numberOfItems": 1
}

Get current file system events configuration.

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns file system events configuration

application/json

get

/settings/events

HTTPcURLJavaScriptPython

GET /settings/events HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns file system events configuration

{
  "queryingDelay": "text",
  "savingDelay": "text"
}

Update file system events configuration.

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

queryingDelaystring · date-spanOptional

savingDelaystring · date-spanOptional

Responses

200

File system events configuration has been updated

application/json

400

Bad request was sent

application/json

put

/settings/events

HTTPcURLJavaScriptPython

PUT /settings/events HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 45

{
  "queryingDelay": "text",
  "savingDelay": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "queryingDelay": "text",
  "savingDelay": "text"
}

Get current honeypot configuration.

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Honeypot configuration has been updated

text/plainapplication/jsontext/json

get

/settings/honeypot

HTTPcURLJavaScriptPython

GET /settings/honeypot HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Honeypot configuration has been updated

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Add placement path to honeypot configuration

post

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPathstring · min: 1Required

Responses

200

Placement path added

text/plainapplication/jsontext/json

400

Bad request was sent

text/plainapplication/jsontext/json

post

/settings/honeypot

HTTPcURLJavaScriptPython

POST /settings/honeypot HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 24

{
  "placementPath": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Update honeypot configuration.

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPathsstring[]Required

Responses

200

Honeypot configuration has been updated

text/plainapplication/jsontext/json

400

Bad request was sent

text/plainapplication/jsontext/json

put

/settings/honeypot

HTTPcURLJavaScriptPython

PUT /settings/honeypot HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 27

{
  "placementPaths": [
    "text"
  ]
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Remove placement path from honeypot configuration

delete

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Query parameters

pathstringOptional

Responses

200

Placement path removed

text/plainapplication/jsontext/json

400

Bad request was sent

text/plainapplication/jsontext/json

delete

/settings/honeypot

HTTPcURLJavaScriptPython

DELETE /settings/honeypot HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Get current security incident detection configuration

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns current configuration

application/json

get

/settings/security-incidents

HTTPcURLJavaScriptPython

GET /settings/security-incidents HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns current configuration

{
  "enabled": true,
  "inactivityPeriod": "text"
}

Update security incident detection configuration

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Security incident detection configuration update request

enabledbooleanRequired

Indicates if security incident detection is enabled

inactivityPeriodstring · date-spanRequired

A period of inactivity after which incidents will be closed

Responses

200

Returns successfully updated configuration

application/json

400

Bad request was sent

application/json

put

/settings/security-incidents

HTTPcURLJavaScriptPython

PUT /settings/security-incidents HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 42

{
  "enabled": true,
  "inactivityPeriod": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "enabled": true,
  "inactivityPeriod": "text"
}

Get all security incidents

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Query parameters

userstringOptional

Responses

200

Returns a list of all detected security incidents

application/json

get

/security-incidents

HTTPcURLJavaScriptPython

GET /security-incidents HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns a list of all detected security incidents

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "user": "text",
    "start": "2025-12-14T18:34:11.985Z",
    "end": "2025-12-14T18:34:11.985Z"
  }
]

Get all alerts linked to a specified incident

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Path parameters

idstring · uuidRequired

Responses

200

Returns a list of linked alerts

application/json

get

/security-incidents/{id}/alerts

HTTPcURLJavaScriptPython

GET /security-incidents/{id}/alerts HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Returns a list of linked alerts

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "occurredAt": "2025-12-14T18:34:11.985Z",
    "type": {
      "id": 1,
      "name": "text"
    },
    "userName": "text"
  }
]

Returns block list info

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns block list info

text/plainapplication/jsontext/json

404

Block list file not found

text/plainapplication/jsontext/json

get

/settings/block-list

HTTPcURLJavaScriptPython

GET /settings/block-list HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "lastUpdated": "2025-12-14T18:34:11.985Z",
  "patternFilters": [
    {
      "regex": {
        "options": 0,
        "rightToLeft": true,
        "matchTimeout": "text"
      },
      "value": "text"
    }
  ]
}

Update block list patterns

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

lastUpdatedstring · date-timeRequired

filtersstring[]Required

Responses

204

Block list patterns were updated

304

Block list was not modified because it is already up to date

400

Bad request was sent

text/plainapplication/jsontext/json

put

/settings/block-list

HTTPcURLJavaScriptPython

PUT /settings/block-list HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 61

{
  "lastUpdated": "2025-12-14T18:34:11.985Z",
  "filters": [
    "text"
  ]
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

No content

Returns skip list info

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Returns skip list info

text/plainapplication/jsontext/json

404

Skip list file not found

text/plainapplication/jsontext/json

get

/settings/block-list/skip

HTTPcURLJavaScriptPython

GET /settings/block-list/skip HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

{
  "filters": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "createdDate": "2025-12-14T18:34:11.985Z",
      "pattern": "text"
    }
  ]
}

Add pattern to skip list

post

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

patternstring · min: 1Required

Responses

204

Skip pattern added

400

Bad request was sent

text/plainapplication/jsontext/json

404

Skip list file not found

text/plainapplication/jsontext/json

409

Pattern already exists in skip list

text/plainapplication/jsontext/json

post

/settings/block-list/skip

HTTPcURLJavaScriptPython

POST /settings/block-list/skip HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 18

{
  "pattern": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

No content

Update skip list patterns

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

filtersstring[]Required

Responses

204

Skip list patterns updated

400

Bad request was sent

text/plainapplication/jsontext/json

put

/settings/block-list/skip

HTTPcURLJavaScriptPython

PUT /settings/block-list/skip HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 20

{
  "filters": [
    "text"
  ]
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

No content

Remove pattern from skip list

delete

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Path parameters

idstring · uuidRequired

Responses

204

Skip pattern removed

400

Bad request was sent

text/plainapplication/jsontext/json

404

Skip list file not found

text/plainapplication/jsontext/json

delete

/settings/block-list/skip/{id}

HTTPcURLJavaScriptPython

DELETE /settings/block-list/skip/{id} HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

No content

Returns current SMB monitoring configuration

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Configuration retrieval succeeded

application/json

get

/settings/smb

HTTPcURLJavaScriptPython

GET /settings/smb HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Configuration retrieval succeeded

{
  "enabled": true,
  "message": {
    "separator": "text",
    "template": "text"
  },
  "listener": {
    "port": 1,
    "endMarker": "text"
  }
}

Updates SMB monitoring configuration

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabledbooleanRequired

Responses

200

Configuration update succeeded

application/json

400

Bad request was sent

application/json

put

/settings/smb

HTTPcURLJavaScriptPython

PUT /settings/smb HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 106

{
  "enabled": true,
  "message": {
    "separator": "text",
    "template": "text"
  },
  "listener": {
    "port": 1,
    "endMarker": "text"
  }
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "enabled": true,
  "message": {
    "separator": "text",
    "template": "text"
  },
  "listener": {
    "port": 1,
    "endMarker": "text"
  }
}

Get current threshold configuration.

get

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Responses

200

Threshold configuration has been updated

text/plainapplication/jsontext/json

get

/settings/threshold

HTTPcURLJavaScriptPython

GET /settings/threshold HTTP/1.1
Host: 
Authorization: Basic username:password
Accept: */*

200

Threshold configuration has been updated

{
  "entropyCheck": {
    "enabled": true,
    "maxCheckAttempts": 1
  },
  "magicNumberCheck": {
    "enabled": true,
    "filesChecked": 1
  },
  "numberOfBuckets": 1,
  "pointsLimit": 1,
  "writesPerSecond": {
    "high": 1,
    "medium": 1,
    "low": 1
  },
  "riskWeights": {
    "high": 1,
    "medium": 1,
    "low": 1
  }
}

Update threshold configuration.

put

Authorizations

basic

AuthorizationstringRequired

Basic Authorization header

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

numberOfBucketsinteger · int32 · max: 1000Required

Number of threshold buckets

pointsLimitinteger · int32 · max: 1000Required

Limit of data points to analyze

Responses

200

Threshold configuration has been updated

text/plainapplication/jsontext/json

400

Bad request was sent

text/plainapplication/jsontext/json

put

/settings/threshold

HTTPcURLJavaScriptPython

PUT /settings/threshold HTTP/1.1
Host: 
Authorization: Basic username:password
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 235

{
  "entropyCheck": {
    "enabled": true,
    "maxCheckAttempts": 1
  },
  "magicNumberCheck": {
    "enabled": true,
    "filesChecked": 1
  },
  "numberOfBuckets": 1,
  "pointsLimit": 1,
  "writesPerSecond": {
    "high": 1,
    "medium": 1,
    "low": 1
  },
  "riskWeights": {
    "high": 1,
    "medium": 1,
    "low": 1
  }
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "entropyCheck": {
    "enabled": true,
    "maxCheckAttempts": 1
  },
  "magicNumberCheck": {
    "enabled": true,
    "filesChecked": 1
  },
  "numberOfBuckets": 1,
  "pointsLimit": 1,
  "writesPerSecond": {
    "high": 1,
    "medium": 1,
    "low": 1
  },
  "riskWeights": {
    "high": 1,
    "medium": 1,
    "low": 1
  }
}