REST API Documentation

Returns all agent tags

GET/settings/tags

Header parameters

Response

200

A list of all currently added tags

Body

text/plainapplication/jsontext/json

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "tag": "text",
    "createdAt": "2024-12-21T12:43:36.763Z"
  }
]

Adds a new agent tag

POST/settings/tags

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

tag*string

Response

201400409

Tag was successfully added

Body

text/plainapplication/jsontext/json

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "tag": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "tag": "text",
  "createdAt": "2024-12-21T12:43:36.763Z"
}

Removes an agent tag

DELETE/settings/tags/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

Tag was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Update password for default user

PUT/authentication/password

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

newPassword*string

Response

204400500

Password was successfully updated

Request

JavaScriptCurlPython

const response = await fetch('/authentication/password', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "newPassword": "text"
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Get current file system events configuration

GET/settings/events

Header parameters

Response

200

Current file system events configuration

Body

application/json

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

JavaScriptCurlPython

const response = await fetch('/settings/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "inactivityPeriod": "text"
  }
}

Update file system events configuration

PUT/settings/events

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

queryingDelaystring (date-span)

savingDelaystring (date-span)

Response

200400

Updated file system events configuration

Body

application/json

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

JavaScriptCurlPython

const response = await fetch('/settings/events', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({}),
});
const data = await response.json();

Response

200400

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "inactivityPeriod": "text"
  }
}

Get all excluded paths

GET/settings/excluded-paths

Header parameters

Response

200404

Current listing of excluded paths

Body

text/plainapplication/jsontext/json

paths*array of ExcludedPathResponse (object)

A collection of excluded paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "path": "text",
      "user": "text"
    }
  ]
}

Create new excluded path

POST/settings/excluded-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

201400404409

An excluded path entry was created

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400404409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Get single excluded path

GET/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

200404

A single excluded path

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Remove excluded path

DELETE/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

204404

Excluded path was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

404

{
  "code": "text",
  "message": "text"
}

GET/settings/reports/file-event-report

Header parameters

Response

200

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

timeZone*string

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "timeZone": "text",
  "scheduledHours": [
    "text"
  ]
}

PUT/settings/reports/file-event-report

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabled*boolean

timeZone*string

Response

200400

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

timeZone*string

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false,
      "timeZone": "text"
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "timeZone": "text",
  "scheduledHours": [
    "text"
  ]
}

POST/settings/reports/file-event-report/hours

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

hour*string (time)

Response

200400409

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

timeZone*string

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "hour": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "enabled": false,
  "timeZone": "text",
  "scheduledHours": [
    "text"
  ]
}

DELETE/settings/reports/file-event-report/hours

Query parameters

Header parameters

Response

200400422

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

timeZone*string

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400422

{
  "enabled": false,
  "timeZone": "text",
  "scheduledHours": [
    "text"
  ]
}

GET/settings/reports/file-event-report/excluded-paths

Header parameters

Response

200

Success

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

POST/settings/reports/file-event-report/excluded-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

201400409

Created

Body

text/plainapplication/jsontext/json

idstring (uuid)

prefixFilePath (object)

usernamenullable string

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "prefix": {
    "isQualified": false,
    "fileName": "text"
  },
  "username": "text"
}

DELETE/settings/reports/file-event-report/excluded-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

No Content

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

GET/settings/reports/file-event-report/timezones

Header parameters

Response

200

Success

Body

text/plainapplication/jsontext/json

id*string

offset*string (date-span)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/timezones', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "text",
    "offset": "text"
  }
]

Returns current file integrity configuration

GET/settings/file-integrity

Header parameters

Response

200

File integrity configuration

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Adds new monitored path to file integrity configuration

POST/settings/file-integrity

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

prefix*string

Path prefix to monitor

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

200201400409

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false,
      "prefix": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates file integrity strategy configuration

PUT/settings/file-integrity

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

enabled*boolean

Indicates if the file integrity strategy is enabled

Response

200400

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Removes path with specified ID from file integrity configuration

DELETE/settings/file-integrity

Query parameters

Header parameters

Response

200204400

Path was successfully removed

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates one of monitored paths

PUT/settings/file-integrity/{id}

Path parameters

id*string (uuid)

ID of path to update

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

200404

Success

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity/{id}', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false
    }),
});
const data = await response.json();

Response

200404

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

List all file system event types

GET/events/types

Header parameters

Response

200

A collection of all file system event types

Body

application/json

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

JavaScriptCurlPython

const response = await fetch('/events/types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": 0,
    "name": "text"
  }
]

List file system events

GET/events

Query parameters

Header parameters

Response

200400

A collection of file system events

Body

application/json

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

JavaScriptCurlPython

const response = await fetch('/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-12-21T12:43:36.763Z",
      "insertionTimeStamp": "2024-12-21T12:43:36.763Z",
      "type": {
        "id": 0,
        "name": "text"
      },
      "username": "text",
      "pid": 0,
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text",
  "numberOfItems": 0
}

Get current honeypot configuration

GET/settings/honeypot

Header parameters

Response

200

Current honeypot configuration

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Add placement path to honeypot configuration

POST/settings/honeypot

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPath*string

Response

200400

An updated honeypot configuration with the new placement path

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPath": "text"
    }),
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Update honeypot configuration

PUT/settings/honeypot

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPaths*array of string

A set of placement paths

Response

200400

Updated honeypot configuration

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPaths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Remove placement path from honeypot configuration

DELETE/settings/honeypot

Query parameters

Header parameters

Response

200400

An updated honeypot configuration without the selected placement path

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

List all security incidents

GET/security-incidents

Query parameters

Header parameters

Response

200

A list of all detected security incidents

Body

application/json

id*string (uuid)

Identifier of the incident

user*string

User for whom the incident was opened

start*string (date-time)

Incident start time

endnullable string (date-time)

Incident end time, or null if it is still ongoing

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "user": "text",
    "start": "2024-12-21T12:43:36.763Z",
    "end": "2024-12-21T12:43:36.763Z"
  }
]

List all affected files linked to an incident with provided identifier

GET/security-incidents/{incidentId}/files

Path parameters

incidentId*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

200400404

A list of affected files connected to an incident with a given identifier

Body

application/json

originalPath*string

Path to affected file before the incident started

mostRecentPath*string

Last registered path to affected file

firstModificationTime*string (date-time)

Time of the first suspicious modification of this affected file

modification*LookupItem (object)

Represents enumeration values, defined by ID and name

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/{incidentId}/files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

[
  {
    "originalPath": "text",
    "mostRecentPath": "text",
    "firstModificationTime": "2024-12-21T12:43:36.763Z",
    "modification": {
      "id": 0,
      "name": "text"
    }
  }
]

Get suspicious events connected to an incident with provided identifier

GET/security-incidents/{id}/events

Path parameters

id*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

200400404

A collection of events connected to an incident with a given identifier

Body

application/json

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/{id}/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-12-21T12:43:36.763Z",
      "insertionTimeStamp": "2024-12-21T12:43:36.763Z",
      "type": {
        "id": 0,
        "name": "text"
      },
      "username": "text",
      "pid": 0,
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text",
  "numberOfItems": 0
}

Get all possible values of affected file modification types

GET/security-incidents/modification-types

Header parameters

Response

200

A list of all possible values of affected file modification types

Body

application/json

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/modification-types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": 0,
    "name": "text"
  }
]

Registers the agent's node with a management server

POST/registrations

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Registration request

instance_id*string (uuid)

Agent instance identifier

server_address*string

The Guard Mode management server address/host

key_id*string (uuid)

API key identifier

api_key_secret*string

API key secret

Response

200400409

Registration response with an extra data about the node

Body

text/plainapplication/jsontext/json

fqdn*string

Fully qualified domain name of the registered agent

operatingSystemnullable string

Agent's operating system

Request

JavaScriptCurlPython

const response = await fetch('/registrations', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "api_key_secret": "text",
      "instance_id": "123e4567-e89b-12d3-a456-426614174000",
      "key_id": "123e4567-e89b-12d3-a456-426614174000",
      "server_address": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "fqdn": "text",
  "operatingSystem": "text"
}

Removes the current registration from a management server

DELETE/registrations

Header parameters

Response

204

Registration is removed

Request

JavaScriptCurlPython

const response = await fetch('/registrations', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Returns block list information

GET/settings/block-list

Header parameters

Response

200

Current block list data

Body

text/plainapplication/jsontext/json

lastUpdated*string (date-time)

A timestamp which indicates when the block list was last updated

fileGroupCount*integer (int64)

Count of pattern/file groups

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "lastUpdated": "2024-12-21T12:43:36.763Z",
  "fileGroupCount": 0
}

Update block list patterns

PUT/settings/block-list

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

lastUpdated*string (date-time)

The timestamp which will be set as the 'last update time' for the block list

filters*array of string

Collection of path filters

Response

204304400

Block list patterns were updated

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ],
      "lastUpdated": "2024-12-21T12:43:36.763Z"
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Returns skip list information

GET/settings/block-list/skip

Header parameters

Response

200

Current skip list

Body

text/plainapplication/jsontext/json

filters*array of SkipListResponseItem (object)

List of skip list filter patterns

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "filters": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "createdDate": "2024-12-21T12:43:36.763Z",
      "pattern": "text"
    }
  ]
}

Add a pattern to skip list

POST/settings/block-list/skip

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

pattern*string

File path pattern

Response

204400409

Skip pattern added

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "pattern": "text"
    }),
});
const data = await response.json();

Response

400409

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Update skip list patterns

PUT/settings/block-list/skip

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

filters*array of string

Collection of path filters

Response

204400

Skip list patterns updated

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ]
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Remove a pattern from skip list

DELETE/settings/block-list/skip/{id}

Path parameters

id*string (uuid)

Skip list pattern identifier

Header parameters

Response

204400

Skip pattern was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Get all scans

GET/scans

Query parameters

Header parameters

Response

200400

Returns a list of all scans, both ended and ongoing

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAtnullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPathnullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

stateLookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "startedAt": "2024-12-21T12:43:36.763Z",
    "endedAt": "2024-12-21T12:43:36.763Z",
    "lastScannedPath": "text",
    "scannedFilesCount": 0,
    "suspiciousFilesCount": 0,
    "state": {
      "id": 0,
      "name": "text"
    },
    "pathsToScan": [
      {
        "value": "text",
        "errorMessage": "text"
      }
    ]
  }
]

Start new scan

POST/scans

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

paths*array of string

Paths that will be recursively scanned

checkBlockListPatterns*boolean

Indicates if file names found during scan should be analyzed to find files with names often used by ransomware

sendAlertsboolean

If true, Agent will raise alert on suspicious file found

Response

200202400

Returns a newly created scan

Request

JavaScriptCurlPython

const response = await fetch('/scans', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkBlockListPatterns": false,
      "paths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Get a scan with a given ID

GET/scans/{id}

Path parameters

id*string (uuid)

Header parameters

Response

200404

Returns a scan with provided ID

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAtnullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPathnullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

stateLookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-12-21T12:43:36.763Z",
  "endedAt": "2024-12-21T12:43:36.763Z",
  "lastScannedPath": "text",
  "scannedFilesCount": 0,
  "suspiciousFilesCount": 0,
  "state": {
    "id": 0,
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Get suspicious files' details from a scan with a given ID

GET/scans/{id}/suspicious-files

Path parameters

id*string (uuid)

Query parameters

Header parameters

Response

200400404

Returns a list of suspicious files found by this scan

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAtnullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPathnullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

stateLookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}/suspicious-files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-12-21T12:43:36.763Z",
  "endedAt": "2024-12-21T12:43:36.763Z",
  "lastScannedPath": "text",
  "scannedFilesCount": 0,
  "suspiciousFilesCount": 0,
  "state": {
    "id": 0,
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Attempts to stop a scan with given ID

POST/scans/{id}/stop

Path parameters

id*string (uuid)

Header parameters

Response

200204404422

Scan was successfully stopped

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}/stop', {
    method: 'POST',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

404422

{
  "code": "text",
  "message": "text"
}

Returns current SMB monitoring configuration

GET/settings/smb

Header parameters

Response

200

Current SMB monitoring configuration

Body

application/json

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/smb', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "port": 0,
    "endMarker": "text"
  }
}

Updates SMB monitoring configuration

PUT/settings/smb

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabled*boolean

message*SmbParserConfigurationRequest (object)

listener*SmbListenerConfigurationRequest (object)

Response

200400

Updated SMB monitoring configuration

Body

application/json

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/smb', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false,
      "listener": {
        "endMarker": "text",
        "port": 0
      },
      "message": {
        "template": "text"
      }
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "port": 0,
    "endMarker": "text"
  }
}

Get current threshold configuration.

GET/settings/threshold

Header parameters

Response

200

Current threshold configuration

Body

text/plainapplication/jsontext/json

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

JavaScriptCurlPython

const response = await fetch('/settings/threshold', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "entropyCheck": {
    "enabled": false,
    "maxCheckAttempts": 0
  },
  "magicNumberCheck": {
    "enabled": false,
    "filesChecked": 0
  },
  "numberOfBuckets": 0,
  "pointsLimit": 0,
  "writesPerSecond": {
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "riskWeights": {
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

Update threshold configuration.

PUT/settings/threshold

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

entropyCheck*EntropyCheck (object)

magicNumberCheckMagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Response

200400

Updated threshold configuration

Body

text/plainapplication/jsontext/json

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

JavaScriptCurlPython

const response = await fetch('/settings/threshold', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "entropyCheck": {
        "enabled": false
      },
      "numberOfBuckets": 0,
      "pointsLimit": 0,
      "riskWeights": {
        "high": 0,
        "low": 0,
        "medium": 0
      },
      "writesPerSecond": {
        "high": 0,
        "low": 0,
        "medium": 0
      }
    }),
});
const data = await response.json();

Response

200400

{
  "entropyCheck": {
    "enabled": false,
    "maxCheckAttempts": 0
  },
  "magicNumberCheck": {
    "enabled": false,
    "filesChecked": 0
  },
  "numberOfBuckets": 0,
  "pointsLimit": 0,
  "writesPerSecond": {
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "riskWeights": {
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

Get OpenTelemetry metrics of the Agent as a Prometheus log

GET/metrics

Response

200

Success

Request

JavaScriptCurlPython

const response = await fetch('/metrics', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Get Agent's healtcheck

GET/health

Response

200

Success

Request

JavaScriptCurlPython

const response = await fetch('/health', {
    method: 'GET',
    headers: {},
});
const data = await response.json();