Excluding Paths From Event Reports

The Excluded Paths allow to exclude specific paths from appearing in Event Reports, providing more focused monitoring. It also allows you to specify a user to exclude their action within a directory from a report.

Attention! This feature is separate from global path exclusions described in the Excluded paths configuration.

Paths excluded from Event Reports will be monitored for threats but will not be included in the event reports.

Viewing Event Reports excluded paths

To see the current list of excluded paths (empty by default), send a GET request to /settings/reports/file-event-report/excluded-paths:

get

Authorizations

Header parameters

api-versionstringRequired

Responses

200

Success

text/plainapplication/jsontext/json

get

HTTPcURLJavaScriptPython

GET /settings/reports/file-event-report/excluded-paths HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Accept: */*

200

Success

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

Each entry has a unique ID, path, and user.

Adding Event Reports excluded paths

To add paths to the exclusion list, Send a POST request to /settings/reports/file-event-report/excluded-paths:

post

Authorizations

Header parameters

api-versionstringRequired

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

pathstring · min: 1Required

Path to exclude

userstring | nullableOptional

Username for which the path should be excluded from monitoring

Responses

201

Created

text/plainapplication/jsontext/json

400

Bad Request

text/plainapplication/jsontext/json

409

Conflict

text/plainapplication/jsontext/json

post

HTTPcURLJavaScriptPython

POST /settings/reports/file-event-report/excluded-paths HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Content-Type: application/json-patch+json
Accept: */*
Content-Length: 29

{
  "path": "text",
  "user": "text"
}

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "prefix": {
    "isQualified": true,
    "fileName": "text"
  },
  "username": "text"
}

Make sure to include the absolute path and an associated user in the body of your request, for example:

{
  "path": "/path/to/exclude",
  "user": "root"
}

To exclude the path for all users, leave the user key empty or set it to null.

Deleting Event Reports excluded paths

To remove a path from exclusions, send a DELETE request to /settings/report/file-event-report/excluded-paths/{id}:

delete

Authorizations

Path parameters

idstring · uuidRequired

Header parameters

api-versionstringRequired

Responses

204

No Content

400

Bad Request

text/plainapplication/jsontext/json

delete

HTTPcURLJavaScriptPython

DELETE /settings/reports/file-event-report/excluded-paths/{id} HTTP/1.1
Host: 
Authorization: Basic username:password
api-version: text
Accept: */*

No content

Tip. You can get the ID of a path using a GET request to the same endpoint.