REST API Documentation

See also. To access the Swagger API using HTTPS, see Using TLS.

Returns all agent tags

GET/settings/tags

Header parameters

Response

200

A list of all currently added tags

Body

text/plainapplication/jsontext/json

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "tag": "text",
    "createdAt": "2024-12-30T14:49:44.215Z"
  }
]

Adds a new agent tag

POST/settings/tags

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

tag*string

Response

201400409

Tag was successfully added

Body

text/plainapplication/jsontext/json

id*string (uuid)

tag*string

createdAt*string (date-time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "tag": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "tag": "text",
  "createdAt": "2024-12-30T14:49:44.215Z"
}

Removes an agent tag

DELETE/settings/tags/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

Tag was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/tags/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Update password for default user

PUT/authentication/password

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

newPassword*string

Response

204400500

Password was successfully updated

Request

JavaScriptCurlPython

const response = await fetch('/authentication/password', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "newPassword": "text"
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Update file system events configuration

PUT/settings/events

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

queryingDelay*string (date-span)

savingDelay*string (date-span)

Response

200400

Updated file system events configuration

Body

application/json

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

JavaScriptCurlPython

const response = await fetch('/settings/events', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "queryingDelay": "text",
      "savingDelay": "text"
    }),
});
const data = await response.json();

Response

200400

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "yaraAnalysisEnabled": false,
    "inactivityPeriod": "text"
  }
}

Get current file system events configuration

GET/settings/events

Header parameters

Response

200

Current file system events configuration

Body

application/json

queryingDelay*string (date-span)

Controls the frequency of the execution of queries that access file system events, like all detection strategies

savingDelay*string (date-span)

Indicates how often the events are saved to the database

incidentDetection*IncidentConfigurationResponse (object)

Security incident detection configuration update response

Request

JavaScriptCurlPython

const response = await fetch('/settings/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "queryingDelay": "text",
  "savingDelay": "text",
  "incidentDetection": {
    "enabled": false,
    "yaraAnalysisEnabled": false,
    "inactivityPeriod": "text"
  }
}

Get all excluded paths

GET/settings/excluded-paths

Header parameters

Response

200404

Current listing of excluded paths

Body

text/plainapplication/jsontext/json

paths*array of ExcludedPathResponse (object)

A collection of excluded paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "path": "text",
      "user": "text"
    }
  ]
}

Create new excluded path

POST/settings/excluded-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

201400404409

An excluded path entry was created

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400404409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

Remove excluded path

DELETE/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

204404

Excluded path was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

404

{
  "code": "text",
  "message": "text"
}

Get single excluded path

GET/settings/excluded-paths/{id}

Path parameters

id*string (uuid)

Excluded path identifier

Header parameters

Response

200404

A single excluded path

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/excluded-paths/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

GET/settings/reports/file-event-report

Header parameters

Response

200

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

PUT/settings/reports/file-event-report

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabled*boolean

Response

200400

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

POST/settings/reports/file-event-report/hours

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

hour*string (time)

Response

200400409

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "hour": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

DELETE/settings/reports/file-event-report/hours

Query parameters

Header parameters

Response

200400422

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

scheduledHours*array of string (time)

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/hours', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400422

{
  "enabled": false,
  "scheduledHours": [
    "text"
  ]
}

GET/settings/reports/file-event-report/excluded-paths

Header parameters

Response

200

OK

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

POST/settings/reports/file-event-report/excluded-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Response

201400409

Created

Body

text/plainapplication/jsontext/json

id*string (uuid)

Excluded path identifier

path*string

Path to exclude

usernullable string

Username for which the path should be excluded from monitoring

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

DELETE/settings/reports/file-event-report/excluded-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

No Content

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/excluded-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

GET/settings/reports/file-event-report/included-paths

Header parameters

Response

200

OK

Body

text/plainapplication/jsontext/json

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "path": "text",
    "user": "text"
  }
]

POST/settings/reports/file-event-report/included-paths

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Response

201400409

Created

Body

text/plainapplication/jsontext/json

id*string (uuid)

Included path identifier

path*string

Path to include

usernullable string

Username for which the path should be included in file event reports

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "path": "text"
    }),
});
const data = await response.json();

Response

201400409

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "path": "text",
  "user": "text"
}

DELETE/settings/reports/file-event-report/included-paths/{id}

Path parameters

id*string (uuid)

Header parameters

Response

204400

No Content

Request

JavaScriptCurlPython

const response = await fetch('/settings/reports/file-event-report/included-paths/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Returns current file integrity configuration

GET/settings/file-integrity

Header parameters

Response

200

File integrity configuration

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Adds new monitored path to file integrity configuration

POST/settings/file-integrity

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

prefix*string

Path prefix to monitor

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

200201400409

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false,
      "prefix": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates file integrity strategy configuration

PUT/settings/file-integrity

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

enabled*boolean

Indicates if the file integrity strategy is enabled

Response

200400

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Removes path with specified ID from file integrity configuration

DELETE/settings/file-integrity

Query parameters

Header parameters

Response

200204400

Path was successfully removed

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

Updates one of monitored paths

PUT/settings/file-integrity/{id}

Path parameters

id*string (uuid)

ID of path to update

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Request received

checkFileContents*boolean

Indicates if the file contents are checked to reduce number of false positives

Response

200404

OK

Body

text/plainapplication/jsontext/json

enabled*boolean

Indicates if the file integrity strategy is enabled

paths*array of FileIntegrityPathResponse (object)

List of monitored paths

Request

JavaScriptCurlPython

const response = await fetch('/settings/file-integrity/{id}', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkFileContents": false
    }),
});
const data = await response.json();

Response

200404

{
  "enabled": false,
  "paths": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "prefix": "text",
      "checkFileContents": false
    }
  ]
}

List all file system event types

GET/events/types

Header parameters

Response

200

A collection of all file system event types

Body

application/json

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

JavaScriptCurlPython

const response = await fetch('/events/types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": 0,
    "name": "text"
  }
]

List file system events

GET/events

Query parameters

Header parameters

Response

200400

A collection of file system events

Body

application/json

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

JavaScriptCurlPython

const response = await fetch('/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-12-30T14:49:44.215Z",
      "insertionTimeStamp": "2024-12-30T14:49:44.215Z",
      "type": {
        "id": 0,
        "name": "text"
      },
      "username": "text",
      "pid": 0,
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text",
  "numberOfItems": 0
}

Update honeypot configuration

PUT/settings/honeypot

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPaths*array of string

A set of placement paths

sourcePathnullable string

Source path honeypot files

Response

200400

Updated honeypot configuration

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPaths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Get current honeypot configuration

GET/settings/honeypot

Header parameters

Response

200

Current honeypot configuration

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Add placement path to honeypot configuration

POST/settings/honeypot

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

placementPath*string

A set of placement paths

Response

200400

An updated honeypot configuration with the new placement path

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "placementPath": "text"
    }),
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

Remove placement path from honeypot configuration

DELETE/settings/honeypot

Query parameters

Header parameters

Response

200400

An updated honeypot configuration without the selected placement path

Body

text/plainapplication/jsontext/json

sourcePath*string

Honeypot files source path

placementPaths*array of string

File placement path collection

Request

JavaScriptCurlPython

const response = await fetch('/settings/honeypot', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

{
  "sourcePath": "text",
  "placementPaths": [
    "text"
  ]
}

List all affected files linked to an incident with provided identifier

GET/security-incidents/{incidentId}/files

Path parameters

incidentId*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

200400404

A list of affected files connected to an incident with a given identifier

Body

application/json

originalPath*string

Path to affected file before the incident started

mostRecentPath*string

Last registered path to affected file

firstModificationTime*string (date-time)

Time of the first suspicious modification of this affected file

modification*LookupItem (object)

Represents enumeration values, defined by ID and name

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/{incidentId}/files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

[
  {
    "originalPath": "text",
    "mostRecentPath": "text",
    "firstModificationTime": "2024-12-30T14:49:44.215Z",
    "modification": {
      "id": 0,
      "name": "text"
    }
  }
]

Get suspicious events connected to an incident with provided identifier

GET/security-incidents/{id}/events

Path parameters

id*string (uuid)

Incident identifier

Query parameters

Header parameters

Response

200400404

A collection of events connected to an incident with a given identifier

Body

application/json

events*array of EventItemResponse (object)

nextRequestCursornullable string

numberOfItems*integer (int32)

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/{id}/events', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

{
  "events": [
    {
      "filename": "text",
      "oldFilename": "text",
      "occurrenceTimeStamp": "2024-12-30T14:49:44.215Z",
      "insertionTimeStamp": "2024-12-30T14:49:44.215Z",
      "type": {
        "id": 0,
        "name": "text"
      },
      "username": "text",
      "pid": 0,
      "networkUsername": "text"
    }
  ],
  "nextRequestCursor": "text",
  "numberOfItems": 0
}

List all security incidents

GET/security-incidents

Query parameters

Header parameters

Response

200

A list of all detected security incidents

Body

application/json

id*string (uuid)

Identifier of the incident

user*string

User for whom the incident was opened

start*string (date-time)

Incident start time

end*nullable string (date-time)

Incident end time, or null if it is still ongoing

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "user": "text",
    "start": "2024-12-30T14:49:44.215Z",
    "end": "2024-12-30T14:49:44.215Z"
  }
]

Get all possible values of affected file modification types

GET/security-incidents/modification-types

Header parameters

Response

200

A list of all possible values of affected file modification types

Body

application/json

id*integer (int32)

ID of returned value

name*string

Descriptive name of this value

Request

JavaScriptCurlPython

const response = await fetch('/security-incidents/modification-types', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": 0,
    "name": "text"
  }
]

Registers the agent's node with a management server

POST/registrations

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

Registration request

instance_id*string (uuid)

Agent instance identifier

server_address*string

The Guard Mode management server address/host

key_id*string (uuid)

API key identifier

api_key_secret*string

API key secret

Response

200400409

Registration response with an extra data about the node

Body

text/plainapplication/jsontext/json

fqdn*string

Fully qualified domain name of the registered agent

operatingSystemnullable string

Agent's operating system

Request

JavaScriptCurlPython

const response = await fetch('/registrations', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "api_key_secret": "text",
      "instance_id": "123e4567-e89b-12d3-a456-426614174000",
      "key_id": "123e4567-e89b-12d3-a456-426614174000",
      "server_address": "text"
    }),
});
const data = await response.json();

Response

200400409

{
  "fqdn": "text",
  "operatingSystem": "text"
}

Removes the current registration from a management server

DELETE/registrations

Header parameters

Response

204

Registration is removed

Request

JavaScriptCurlPython

const response = await fetch('/registrations', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Returns block list information

GET/settings/block-list

Header parameters

Response

200

Current block list data

Body

text/plainapplication/jsontext/json

lastUpdated*string (date-time)

A timestamp which indicates when the block list was last updated

fileGroupCount*integer (int64)

Count of pattern/file groups

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "lastUpdated": "2024-12-30T14:49:44.215Z",
  "fileGroupCount": 0
}

Update block list patterns

PUT/settings/block-list

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

lastUpdated*string (date-time)

The timestamp which will be set as the 'last update time' for the block list

filters*array of string

Collection of path filters

Response

204304400

Block list patterns were updated

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ],
      "lastUpdated": "2024-12-30T14:49:44.215Z"
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Returns skip list information

GET/settings/block-list/skip

Header parameters

Response

200

Current skip list

Body

text/plainapplication/jsontext/json

filters*array of SkipListResponseItem (object)

List of skip list filter patterns

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "filters": [
    {
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "createdDate": "2024-12-30T14:49:44.215Z",
      "pattern": "text"
    }
  ]
}

Update skip list patterns

PUT/settings/block-list/skip

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

filters*array of string

Collection of path filters

Response

204400

Skip list patterns updated

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "filters": [
        "*.exe"
      ]
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Add a pattern to skip list

POST/settings/block-list/skip

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

pattern*string

File path pattern

Response

204400409

Skip pattern added

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "pattern": "text"
    }),
});
const data = await response.json();

Response

400409

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Remove a pattern from skip list

DELETE/settings/block-list/skip/{id}

Path parameters

id*string (uuid)

Skip list pattern identifier

Header parameters

Response

204400

Skip pattern was removed

Request

JavaScriptCurlPython

const response = await fetch('/settings/block-list/skip/{id}', {
    method: 'DELETE',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Get all scans

GET/scans

Query parameters

Header parameters

Response

200400

Returns a list of all scans, both ended and ongoing

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400

[
  {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "startedAt": "2024-12-30T14:49:44.215Z",
    "endedAt": "2024-12-30T14:49:44.215Z",
    "lastScannedPath": "text",
    "scannedFilesCount": 0,
    "suspiciousFilesCount": 0,
    "state": {
      "id": 0,
      "name": "text"
    },
    "pathsToScan": [
      {
        "value": "text",
        "errorMessage": "text"
      }
    ]
  }
]

Start new scan

POST/scans

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

paths*array of string

Paths that will be recursively scanned

checkBlockListPatterns*boolean

Indicates if file names found during scan should be analyzed to find files with names often used by ransomware

checkYaraRulesboolean

Indicates if files should be scanned using YARA rules

sendAlertsboolean

If true, Agent will raise alert on suspicious file found

rootMountPointsnullable array of string

If present, causes exclusions to work as if filesystem root was at each of provided paths

Response

200202400

Returns a newly created scan

Request

JavaScriptCurlPython

const response = await fetch('/scans', {
    method: 'POST',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "checkBlockListPatterns": false,
      "paths": [
        "text"
      ]
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Get a scan with a given ID

GET/scans/{id}

Path parameters

id*string (uuid)

Header parameters

Response

200404

Returns a scan with provided ID

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-12-30T14:49:44.215Z",
  "endedAt": "2024-12-30T14:49:44.215Z",
  "lastScannedPath": "text",
  "scannedFilesCount": 0,
  "suspiciousFilesCount": 0,
  "state": {
    "id": 0,
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Get suspicious files' details from a scan with a given ID

GET/scans/{id}/suspicious-files

Path parameters

id*string (uuid)

Query parameters

Header parameters

Response

200400404

Returns a list of suspicious files found by this scan

Body

text/plainapplication/jsontext/json

id*string (uuid)

Identifier of the scan

startedAt*string (date-time)

Scan start time

endedAt*nullable string (date-time)

Scan end time if it has ended, or null otherwise

lastScannedPath*nullable string

Last file path scanned by this scan, or null if no files were scanned yet

scannedFilesCount*integer (int32)

Number of files that were scanned

suspiciousFilesCount*integer (int32)

Number of suspicious files found

state*LookupItem (object)

Represents enumeration values, defined by ID and name

pathsToScan*array of ScannedPathResponse (object)

Paths requested by the user to be scanned

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}/suspicious-files', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200400404

{
  "id": "123e4567-e89b-12d3-a456-426614174000",
  "startedAt": "2024-12-30T14:49:44.215Z",
  "endedAt": "2024-12-30T14:49:44.215Z",
  "lastScannedPath": "text",
  "scannedFilesCount": 0,
  "suspiciousFilesCount": 0,
  "state": {
    "id": 0,
    "name": "text"
  },
  "pathsToScan": [
    {
      "value": "text",
      "errorMessage": "text"
    }
  ]
}

Attempts to stop a scan with given ID

POST/scans/{id}/stop

Path parameters

id*string (uuid)

Header parameters

Response

200204404422

Scan was successfully stopped

Request

JavaScriptCurlPython

const response = await fetch('/scans/{id}/stop', {
    method: 'POST',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

404422

{
  "code": "text",
  "message": "text"
}

Returns current SMB monitoring configuration

GET/settings/smb

Header parameters

Response

200

Current SMB monitoring configuration

Body

application/json

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/smb', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "port": 0,
    "endMarker": "text"
  }
}

Updates SMB monitoring configuration

PUT/settings/smb

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

enabled*boolean

message*SmbParserConfigurationRequest (object)

listener*SmbListenerConfigurationRequest (object)

Response

200400

Updated SMB monitoring configuration

Body

application/json

enabled*boolean

Indicates whether the SMB listener is enabled or disabled

message*SmbParserConfigurationResponse (object)

listener*SmbListenerConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/smb', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "enabled": false,
      "listener": {
        "endMarker": "text",
        "port": 0
      },
      "message": {
        "template": "text"
      }
    }),
});
const data = await response.json();

Response

200400

{
  "enabled": false,
  "message": {
    "template": "text"
  },
  "listener": {
    "port": 0,
    "endMarker": "text"
  }
}

Update threshold configuration.

PUT/settings/threshold

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

entropyCheck*EntropyCheck (object)

magicNumberCheckMagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheckYaraConfigRequest (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Response

200400

Updated threshold configuration

Body

text/plainapplication/jsontext/json

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheck*YaraConfigResponse (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

JavaScriptCurlPython

const response = await fetch('/settings/threshold', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "entropyCheck": {
        "enabled": false
      },
      "numberOfBuckets": 0,
      "pointsLimit": 0,
      "riskWeights": {
        "high": 0,
        "low": 0,
        "medium": 0
      },
      "writesPerSecond": {
        "high": 0,
        "low": 0,
        "medium": 0
      }
    }),
});
const data = await response.json();

Response

200400

{
  "entropyCheck": {
    "enabled": false,
    "maxCheckAttempts": 0
  },
  "magicNumberCheck": {
    "enabled": false,
    "filesChecked": 0
  },
  "yaraCheck": {
    "isEnabled": false
  },
  "numberOfBuckets": 0,
  "pointsLimit": 0,
  "writesPerSecond": {
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "riskWeights": {
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

Get current threshold configuration.

GET/settings/threshold

Header parameters

Response

200

Current threshold configuration

Body

text/plainapplication/jsontext/json

entropyCheck*EntropyCheck (object)

magicNumberCheck*MagicNumberCheck (object)

Indicates if magic number check is enabled and how many files per user are checked

yaraCheck*YaraConfigResponse (object)

numberOfBuckets*integer (int32)

Number of threshold buckets

pointsLimit*integer (int32)

Limit of data points to analyze

writesPerSecond*ThresholdLevel (object)

Indicates the threshold levels of a given setting

riskWeights*ThresholdLevel (object)

Indicates the threshold levels of a given setting

Request

JavaScriptCurlPython

const response = await fetch('/settings/threshold', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "entropyCheck": {
    "enabled": false,
    "maxCheckAttempts": 0
  },
  "magicNumberCheck": {
    "enabled": false,
    "filesChecked": 0
  },
  "yaraCheck": {
    "isEnabled": false
  },
  "numberOfBuckets": 0,
  "pointsLimit": 0,
  "writesPerSecond": {
    "high": 0,
    "medium": 0,
    "low": 0
  },
  "riskWeights": {
    "high": 0,
    "medium": 0,
    "low": 0
  }
}

Get Agent's healtcheck

GET/health

Response

200

Success

Request

JavaScriptCurlPython

const response = await fetch('/health', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Get OpenTelemetry metrics of the Agent as a Prometheus log

GET/metrics

Response

200

Success

Request

JavaScriptCurlPython

const response = await fetch('/metrics', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Update YARA analysis configuration

PUT/settings/yara

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

scans*YaraRuleSourceConfigurationRequest (object)

threshold*YaraRuleSourceConfigurationRequest (object)

fileIntegrity*YaraRuleSourceConfigurationRequest (object)

incidents*YaraRuleSourceConfigurationRequest (object)

Response

200400

Updated configuration

Body

text/plainapplication/jsontext/json

scans*YaraRuleSourceConfigurationResponse (object)

threshold*YaraRuleSourceConfigurationResponse (object)

fileIntegrity*YaraRuleSourceConfigurationResponse (object)

incidents*YaraRuleSourceConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/yara', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "fileIntegrity": {
        "maxFileSizeInBytes": 0,
        "rulesPath": "text"
      },
      "incidents": {
        "maxFileSizeInBytes": 0,
        "rulesPath": "text"
      },
      "scans": {
        "maxFileSizeInBytes": 0,
        "rulesPath": "text"
      },
      "threshold": {
        "maxFileSizeInBytes": 0,
        "rulesPath": "text"
      }
    }),
});
const data = await response.json();

Response

200400

{
  "scans": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "threshold": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "fileIntegrity": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "incidents": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  }
}

Get current YARA analysis configuration

GET/settings/yara

Header parameters

Response

200

Current configuration

Body

text/plainapplication/jsontext/json

scans*YaraRuleSourceConfigurationResponse (object)

threshold*YaraRuleSourceConfigurationResponse (object)

fileIntegrity*YaraRuleSourceConfigurationResponse (object)

incidents*YaraRuleSourceConfigurationResponse (object)

Request

JavaScriptCurlPython

const response = await fetch('/settings/yara', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "scans": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "threshold": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "fileIntegrity": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  },
  "incidents": {
    "rulesPath": "text",
    "maxFileSizeInBytes": 0
  }
}

Returns information about all timezones defined in the system that agent is operating on

GET/settings/available-timezones

Header parameters

Response

200204

OK

Body

text/plainapplication/jsontext/json

id*string

Timezone ID that can be used set this timezone in configuration

offset*string (date-span)

Base UTC offset of this timezone (current offset might be different, depending on daylight saving time, etc.)

Request

JavaScriptCurlPython

const response = await fetch('/settings/available-timezones', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

[
  {
    "id": "text",
    "offset": "text"
  }
]

Updates timezone configuration

PUT/settings/timezone

Header parameters

Body

application/json-patch+jsonapplication/jsontext/jsonapplication/*+json

timeZone*string

ID of a timezone that will be set

Response

204400

Configuration was successfully updated

Request

JavaScriptCurlPython

const response = await fetch('/settings/timezone', {
    method: 'PUT',
    headers: {
      "api-version": "text",
      "Content-Type": "application/json-patch+json"
    },
    body: JSON.stringify({
      "timeZone": "text"
    }),
});
const data = await response.json();

Response

400

{
  "type": "text",
  "title": "text",
  "status": 0,
  "detail": "text",
  "instance": "text"
}

Returns current timezone configuration

GET/settings/timezone

Header parameters

Response

200

Current timezone configuration

Body

text/plainapplication/jsontext/json

timeZone*TimeZoneResponse (object)

Timezone information

Request

JavaScriptCurlPython

const response = await fetch('/settings/timezone', {
    method: 'GET',
    headers: {
      "api-version": "text"
    },
});
const data = await response.json();

Response

200

{
  "timeZone": {
    "id": "text",
    "offset": "text"
  }
}