REST API Documentation | GuardMode 2024.2

Returns all agent tags

GET/settings/tags

Header parameters

Response

A list of all currently added tags

Body

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

const response = await fetch('/settings/tags', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "tag": "text",
    "createdAt": "2024-09-19T16:27:03.648Z"
  }
]

Adds a new agent tag

POST/settings/tags

Header parameters

Body

tag*string

Response

Tag was successfully added

Body

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

const response = await fetch('/settings/tags', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "tag": "text"
    }),
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "tag": "text",
  "createdAt": "2024-09-19T16:27:03.648Z"
}

Removes an agent tag

DELETE/settings/tags/{id}

Path parameters

id*string (uuid)

Header parameters

Response

Tag was removed

Request

const response = await fetch('/settings/tags/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Update password for default user

PUT/authentication/password

Header parameters

Body

newPassword*string

Response

Password was successfully updated

Request

const response = await fetch('/authentication/password', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "newPassword": "text"
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Update file system events configuration

PUT/settings/events

Header parameters

Body

queryingDelay*string (date-span)

savingDelay*string (date-span)

Response

Updated file system events configuration

Body

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

const response = await fetch('/settings/events', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "queryingDelay": "text",
      "savingDelay": "text"
    }),
});
const data = await response.json();

Response

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "yaraAnalysisEnabled": false,
    "inactivityPeriod": "text"
  }
}

Get current file system events configuration

GET/settings/events

Header parameters

Response

Current file system events configuration

Body

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

const response = await fetch('/settings/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "yaraAnalysisEnabled": false,
    "inactivityPeriod": "text"
  }
}

Get all excluded paths

GET/settings/excluded-paths

Header parameters

Response

Current listing of excluded paths

Body

paths*array of ExcludedPathResponse (object)

A collection of excluded paths

Request

const response = await fetch('/settings/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "path": "text",
      "user": "text"
    }
  ]
}

Create new excluded path

POST/settings/excluded-paths

Header parameters

Body

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

An excluded path entry was created

Body

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

const response = await fetch('/settings/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Remove excluded path

DELETE/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

Excluded path was removed

Request

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "code": "text",
  "message": "text"
}

Get single excluded path

GET/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

A single excluded path

Body

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

GET/settings/reports/file-event-report

Header parameters

Response

OK

Body

enabled*boolean

scheduledHours*array of string (time)

Request

const response = await fetch('/settings/reports/file-event-report', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

PUT/settings/reports/file-event-report

Header parameters

Body

enabled*boolean

Response

OK

Body

enabled*boolean

scheduledHours*array of string (time)

Request

const response = await fetch('/settings/reports/file-event-report', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

POST/settings/reports/file-event-report/hours

Header parameters

Body

hour*string (time)

Response

OK

Body

enabled*boolean

scheduledHours*array of string (time)

Request

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "hour": "text"
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

DELETE/settings/reports/file-event-report/hours

Query parameters

Header parameters

Response

OK

Body

enabled*boolean

scheduledHours*array of string (time)

Request

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

GET/settings/reports/file-event-report/excluded-paths

Header parameters

Response

OK

Body

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

POST/settings/reports/file-event-report/excluded-paths

Header parameters

Body

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

Created

Body

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

DELETE/settings/reports/file-event-report/excluded-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

No Content

Request

const response = await fetch('/settings/reports/file-event-report/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

GET/settings/reports/file-event-report/included-paths

Header parameters

Response

OK

Body

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

POST/settings/reports/file-event-report/included-paths

Header parameters

Body

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Response

Created

Body

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

DELETE/settings/reports/file-event-report/included-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

No Content

Request

const response = await fetch('/settings/reports/file-event-report/included-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Returns current file integrity configuration

GET/settings/file-integrity

Header parameters

Response

File integrity configuration

Body

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

const response = await fetch('/settings/file-integrity', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Adds new monitored path to file integrity configuration

POST/settings/file-integrity

Header parameters

Body

Request received

prefix*string

Path prefix to monitor

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

OK

Body

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

const response = await fetch('/settings/file-integrity', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false,
      "prefix": "text"
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates file integrity strategy configuration

PUT/settings/file-integrity

Header parameters

Body

Request received

enabled*boolean

Indicates if the file integrity strategy is enabled

Response

OK

Body

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

const response = await fetch('/settings/file-integrity', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Removes path with specified ID from file integrity configuration

DELETE/settings/file-integrity

Query parameters

Header parameters

Response

Path was successfully removed

Body

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

const response = await fetch('/settings/file-integrity', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates one of monitored paths

PUT/settings/file-integrity/{id}

Path parameters

id*string (uuid)

ID of path to update

Header parameters

Body

Request received

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

OK

Body

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

const response = await fetch('/settings/file-integrity/{id}', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

List all file system event types

GET/events/types

Header parameters

Response

A collection of all file system event types

Body

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

const response = await fetch('/events/types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "name": "text"
  }
]

List file system events

GET/events

Query parameters

Header parameters

Response

A collection of file system events

Body

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

const response = await fetch('/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-09-19T16:27:03.648Z",
      "insertionTimeStamp": "2024-09-19T16:27:03.648Z",
      "type": {
        "name": "text"
      },
      "username": "text",
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text"
}

Update honeypot configuration

PUT/settings/honeypot

Header parameters

Body

placementPaths*array of string

A set of placement paths

sourcePathnullable string

Source path honeypot files

Response

Updated honeypot configuration

Body

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

const response = await fetch('/settings/honeypot', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPaths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Get current honeypot configuration

GET/settings/honeypot

Header parameters

Response

Current honeypot configuration

Body

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

const response = await fetch('/settings/honeypot', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Add placement path to honeypot configuration

POST/settings/honeypot

Header parameters

Body

placementPath*string

A set of placement paths

Response

An updated honeypot configuration with the new placement path

Body

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

const response = await fetch('/settings/honeypot', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPath": "text"
    }),
});
const data = await response.json();

Response

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Remove placement path from honeypot configuration

DELETE/settings/honeypot

Query parameters

Header parameters

Response

An updated honeypot configuration without the selected placement path

Body

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

const response = await fetch('/settings/honeypot', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

List all affected files linked to an incident with provided identifier

GET/security-incidents/{incidentId}/files

Path parameters

incidentId*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

A list of affected files connected to an incident with a given identifier

Body

originalPath*string

Path to affected file before the incident started

mostRecentPath*string

Last registered path to affected file

firstModificationTime*string (date-time)

Time of the first suspicious modification of this affected file

modification*LookupItem (object)

Represents enumeration values, defined by ID and name

Request

const response = await fetch('/security-incidents/{incidentId}/files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "originalPath": "text",
    "mostRecentPath": "text",
    "firstModificationTime": "2024-09-19T16:27:03.648Z",
    "modification": {
      "name": "text"
    }
  }
]

Get suspicious events connected to an incident with provided identifier

GET/security-incidents/{id}/events

Path parameters

id*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

A collection of events connected to an incident with a given identifier

Body

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

const response = await fetch('/security-incidents/{id}/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-09-19T16:27:03.648Z",
      "insertionTimeStamp": "2024-09-19T16:27:03.648Z",
      "type": {
        "name": "text"
      },
      "username": "text",
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text"
}

List all security incidents

GET/security-incidents

Query parameters

Header parameters

Response

A list of all detected security incidents

Body

id*string (uuid)

Identifier of the incident

user*string

User for whom the incident was opened

start*string (date-time)

Incident start time

end*nullable string (date-time)

Incident end time, or null if it is still ongoing

Request

const response = await fetch('/security-incidents', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "user": "text",
    "start": "2024-09-19T16:27:03.648Z",
    "end": "2024-09-19T16:27:03.648Z"
  }
]

Get all possible values of affected file modification types

GET/security-incidents/modification-types

Header parameters

Response

A list of all possible values of affected file modification types

Body

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

const response = await fetch('/security-incidents/modification-types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "name": "text"
  }
]

Registers the agent's node with a management server

POST/registrations

Header parameters

Body

Registration request

instance_id*string (uuid)

Agent instance identifier

server_address*string

The Guard Mode management server address/host

key_id*string (uuid)

API key identifier

api_key_secret*string

API key secret

Response

Registration response with an extra data about the node

Body

fqdn*string

Fully qualified domain name of the registered agent

operatingSystemnullable string

Agent's operating system

Request

const response = await fetch('/registrations', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "api_key_secret": "text",
      "instance_id": "123e4567-e89b-12d3-a456-426614174000",
      "key_id": "123e4567-e89b-12d3-a456-426614174000",
      "server_address": "text"
    }),
});
const data = await response.json();

Response

{
  "fqdn": "text",
  "operatingSystem": "text"
}

Removes the current registration from a management server

DELETE/registrations

Header parameters

Response

Registration is removed

Request

const response = await fetch('/registrations', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Returns block list information

GET/settings/block-list

Header parameters

Response

Current block list data

Body

lastUpdated*string (date-time)

A timestamp which indicates when the block list was last updated

fileGroupCount*integer (int64)

Count of pattern/file groups

Request

const response = await fetch('/settings/block-list', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "lastUpdated": "2024-09-19T16:27:03.648Z"
}

Update block list patterns

PUT/settings/block-list

Header parameters

Body

lastUpdated*string (date-time)

The timestamp which will be set as the 'last update time' for the block list

filters*array of string

Collection of path filters

Response

Block list patterns were updated

Request

const response = await fetch('/settings/block-list', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ],
      "lastUpdated": "2024-09-19T16:27:03.648Z"
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Returns skip list information

GET/settings/block-list/skip

Header parameters

Response

Current skip list

Body

filters*array of SkipListResponseItem (object)

List of skip list filter patterns

Request

const response = await fetch('/settings/block-list/skip', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "filters": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "createdDate": "2024-09-19T16:27:03.648Z",
      "pattern": "text"
    }
  ]
}

Update skip list patterns

PUT/settings/block-list/skip

Header parameters

Body

filters*array of string

Collection of path filters

Response

Skip list patterns updated

Request

const response = await fetch('/settings/block-list/skip', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ]
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Add a pattern to skip list

POST/settings/block-list/skip

Header parameters

Body

pattern*string

File path pattern

Response

Skip pattern added

Request

const response = await fetch('/settings/block-list/skip', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "pattern": "text"
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Remove a pattern from skip list

DELETE/settings/block-list/skip/{id}

Path parameters

id*string (uuid)

Skip list pattern identifier

Header parameters

Response

Skip pattern was removed

Request

const response = await fetch('/settings/block-list/skip/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Get all scans

GET/scans

Query parameters

Header parameters

Response

Returns a list of all scans, both ended and ongoing

Body

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

const response = await fetch('/scans', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "startedAt": "2024-09-19T16:27:03.648Z",
    "endedAt": "2024-09-19T16:27:03.648Z",
    "lastScannedPath": "text",
    "state": {
      "name": "text"
    },
    "pathsToScan": [
      {
        "value": "text",
        "errorMessage": "text"
      }
    ]
  }
]

Start new scan

POST/scans

Header parameters

Body

paths*array of string

Paths that will be recursively scanned

checkBlockListPatterns*boolean

Indicates if file names found during scan should be analyzed to find files with names often used by ransomware

checkYaraRulesboolean

Indicates if files should be scanned using YARA rules

sendAlertsboolean

If true, Agent will raise alert on suspicious file found

rootMountPointsnullable array of string

If present, causes exclusions to work as if filesystem root was at each of provided paths

Response

Returns a newly created scan

Request

const response = await fetch('/scans', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkBlockListPatterns": false,
      "paths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Get a scan with a given ID

GET/scans/{id}

Path parameters

id*string (uuid)

Header parameters

Response

Returns a scan with provided ID

Body

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

const response = await fetch('/scans/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-09-19T16:27:03.648Z",
  "endedAt": "2024-09-19T16:27:03.648Z",
  "lastScannedPath": "text",
  "state": {
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Get suspicious files' details from a scan with a given ID

GET/scans/{id}/suspicious-files

Path parameters

id*string (uuid)

Query parameters

Header parameters

Response

Returns a list of suspicious files found by this scan

Body

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

const response = await fetch('/scans/{id}/suspicious-files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-09-19T16:27:03.648Z",
  "endedAt": "2024-09-19T16:27:03.648Z",
  "lastScannedPath": "text",
  "state": {
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Attempts to stop a scan with given ID

POST/scans/{id}/stop

Path parameters

id*string (uuid)

Header parameters

Response

Scan was successfully stopped

Request

const response = await fetch('/scans/{id}/stop', {
    method: 'POST',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "code": "text",
  "message": "text"
}

Returns current SMB monitoring configuration

GET/settings/smb

Header parameters

Response

Current SMB monitoring configuration

Body

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

const response = await fetch('/settings/smb', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "endMarker": "text"
  }
}

Updates SMB monitoring configuration

PUT/settings/smb

Header parameters

Body

enabled*boolean

message*SmbParserConfigurationRequest (object)

listener*SmbListenerConfigurationRequest (object)

Response

Updated SMB monitoring configuration

Body

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

const response = await fetch('/settings/smb', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false,
      "listener": {
        "endMarker": "text"
      },
      "message": {
        "template": "text"
      }
    }),
});
const data = await response.json();

Response

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "endMarker": "text"
  }
}

Update threshold configuration.

PUT/settings/threshold

Header parameters

Body

entropyCheck*EntropyCheck (object)

magicNumberCheckMagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheckYaraConfigRequest (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Response

Updated threshold configuration

Body

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheck*YaraConfigResponse (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

const response = await fetch('/settings/threshold', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "entropyCheck": {
        "enabled": false
      },
      "riskWeights": {},
      "writesPerSecond": {}
    }),
});
const data = await response.json();

Response

{
  "entropyCheck": {
    "enabled": false
  },
  "magicNumberCheck": {
    "enabled": false
  },
  "yaraCheck": {
    "isEnabled": false
  },
  "writesPerSecond": {},
  "riskWeights": {}
}

Get current threshold configuration.

GET/settings/threshold

Header parameters

Response

Current threshold configuration

Body

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheck*YaraConfigResponse (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

const response = await fetch('/settings/threshold', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "entropyCheck": {
    "enabled": false
  },
  "magicNumberCheck": {
    "enabled": false
  },
  "yaraCheck": {
    "isEnabled": false
  },
  "writesPerSecond": {},
  "riskWeights": {}
}

Get Agent's healtcheck

GET/health

Response

Success

Request

const response = await fetch('/health', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Get OpenTelemetry metrics of the Agent as a Prometheus log

GET/metrics

Response

Success

Request

const response = await fetch('/metrics', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Update YARA analysis configuration

PUT/settings/yara

Header parameters

Body

scans*YaraRuleSourceConfigurationRequest (object)

threshold*YaraRuleSourceConfigurationRequest (object)

fileIntegrity*YaraRuleSourceConfigurationRequest (object)

incidents*YaraRuleSourceConfigurationRequest (object)

Response

Updated configuration

Body

scans*YaraRuleSourceConfigurationResponse (object)

threshold*YaraRuleSourceConfigurationResponse (object)

fileIntegrity*YaraRuleSourceConfigurationResponse (object)

incidents*YaraRuleSourceConfigurationResponse (object)

Request

const response = await fetch('/settings/yara', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "fileIntegrity": {
        "rulesPath": "text"
      },
      "incidents": {
        "rulesPath": "text"
      },
      "scans": {
        "rulesPath": "text"
      },
      "threshold": {
        "rulesPath": "text"
      }
    }),
});
const data = await response.json();

Response

{
  "scans": {
    "rulesPath": "text"
  },
  "threshold": {
    "rulesPath": "text"
  },
  "fileIntegrity": {
    "rulesPath": "text"
  },
  "incidents": {
    "rulesPath": "text"
  }
}

Get current YARA analysis configuration

GET/settings/yara

Header parameters

Response

Current configuration

Body

scans*YaraRuleSourceConfigurationResponse (object)

threshold*YaraRuleSourceConfigurationResponse (object)

fileIntegrity*YaraRuleSourceConfigurationResponse (object)

incidents*YaraRuleSourceConfigurationResponse (object)

Request

const response = await fetch('/settings/yara', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "scans": {
    "rulesPath": "text"
  },
  "threshold": {
    "rulesPath": "text"
  },
  "fileIntegrity": {
    "rulesPath": "text"
  },
  "incidents": {
    "rulesPath": "text"
  }
}

Returns information about all timezones defined in the system that agent is operating on

GET/settings/available-timezones

Header parameters

Response

OK

Body

id*string

Timezone ID that can be used set this timezone in configuration

offset*string (date-span)

Base UTC offset of this timezone (current offset might be different, depending on daylight saving time, etc.)

Request

const response = await fetch('/settings/available-timezones', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

[
  {
    "id": "text",
    "offset": "text"
  }
]

Updates timezone configuration

PUT/settings/timezone

Header parameters

Body

timeZone*string

ID of a timezone that will be set

Response

Configuration was successfully updated

Request

const response = await fetch('/settings/timezone', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "timeZone": "text"
    }),
});
const data = await response.json();

Response

{
  "type": "text",
  "title": "text",
  "detail": "text",
  "instance": "text"
}

Returns current timezone configuration

GET/settings/timezone

Header parameters

Response

Current timezone configuration

Body

timeZone*TimeZoneResponse (object)

Timezone information

Request

const response = await fetch('/settings/timezone', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

{
  "timeZone": {
    "id": "text",
    "offset": "text"
  }
}