@@ -433,6 +433,13 @@ components:
433
433
required: true
434
434
schema:
435
435
type: string
436
+ HistoricalSignalID:
437
+ description: The ID of the historical signal.
438
+ in: path
439
+ name: histsignal_id
440
+ required: true
441
+ schema:
442
+ type: string
436
443
IncidentAttachmentFilterQueryParameter:
437
444
description: Specifies which types of attachments are included in the response.
438
445
explode: false
@@ -745,6 +752,58 @@ components:
745
752
required: true
746
753
schema:
747
754
type: string
755
+ QueryFilterFrom:
756
+ description: The minimum timestamp for requested security signals.
757
+ example: '2019-01-02T09:42:36.320Z'
758
+ in: query
759
+ name: filter[from]
760
+ required: false
761
+ schema:
762
+ format: date-time
763
+ type: string
764
+ QueryFilterSearch:
765
+ description: The search query for security signals.
766
+ example: security:attack status:high
767
+ in: query
768
+ name: filter[query]
769
+ required: false
770
+ schema:
771
+ type: string
772
+ QueryFilterTo:
773
+ description: The maximum timestamp for requested security signals.
774
+ example: '2019-01-03T09:42:36.320Z'
775
+ in: query
776
+ name: filter[to]
777
+ required: false
778
+ schema:
779
+ format: date-time
780
+ type: string
781
+ QueryPageCursor:
782
+ description: A list of results using the cursor provided in the previous query.
783
+ example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
784
+ in: query
785
+ name: page[cursor]
786
+ required: false
787
+ schema:
788
+ type: string
789
+ QueryPageLimit:
790
+ description: The maximum number of security signals in the response.
791
+ example: 25
792
+ in: query
793
+ name: page[limit]
794
+ required: false
795
+ schema:
796
+ default: 10
797
+ format: int32
798
+ maximum: 1000
799
+ type: integer
800
+ QuerySort:
801
+ description: The order of the security signals in results.
802
+ in: query
803
+ name: sort
804
+ required: false
805
+ schema:
806
+ $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
748
807
RelationInclude:
749
808
description: Include relationship data.
750
809
explode: true
@@ -65306,52 +65365,12 @@ paths:
65306
65365
security signals.'
65307
65366
operationId: ListSecurityMonitoringSignals
65308
65367
parameters:
65309
- - description: The search query for security signals.
65310
- example: security:attack status:high
65311
- in: query
65312
- name: filter[query]
65313
- required: false
65314
- schema:
65315
- type: string
65316
- - description: The minimum timestamp for requested security signals.
65317
- example: '2019-01-02T09:42:36.320Z'
65318
- in: query
65319
- name: filter[from]
65320
- required: false
65321
- schema:
65322
- format: date-time
65323
- type: string
65324
- - description: The maximum timestamp for requested security signals.
65325
- example: '2019-01-03T09:42:36.320Z'
65326
- in: query
65327
- name: filter[to]
65328
- required: false
65329
- schema:
65330
- format: date-time
65331
- type: string
65332
- - description: The order of the security signals in results.
65333
- in: query
65334
- name: sort
65335
- required: false
65336
- schema:
65337
- $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
65338
- - description: A list of results using the cursor provided in the previous query.
65339
- example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
65340
- in: query
65341
- name: page[cursor]
65342
- required: false
65343
- schema:
65344
- type: string
65345
- - description: The maximum number of security signals in the response.
65346
- example: 25
65347
- in: query
65348
- name: page[limit]
65349
- required: false
65350
- schema:
65351
- default: 10
65352
- format: int32
65353
- maximum: 1000
65354
- type: integer
65368
+ - $ref: '#/components/parameters/QueryFilterSearch'
65369
+ - $ref: '#/components/parameters/QueryFilterFrom'
65370
+ - $ref: '#/components/parameters/QueryFilterTo'
65371
+ - $ref: '#/components/parameters/QuerySort'
65372
+ - $ref: '#/components/parameters/QueryPageCursor'
65373
+ - $ref: '#/components/parameters/QueryPageLimit'
65355
65374
responses:
65356
65375
'200':
65357
65376
content:
@@ -66632,6 +66651,123 @@ paths:
66632
66651
permissions:
66633
66652
- incident_settings_write
66634
66653
x-unstable: '**Note**: This endpoint is deprecated.'
66654
+ /api/v2/siem-historical-detections/histsignals:
66655
+ get:
66656
+ description: List hist signals.
66657
+ operationId: ListSecurityMonitoringHistsignals
66658
+ parameters:
66659
+ - $ref: '#/components/parameters/QueryFilterSearch'
66660
+ - $ref: '#/components/parameters/QueryFilterFrom'
66661
+ - $ref: '#/components/parameters/QueryFilterTo'
66662
+ - $ref: '#/components/parameters/QuerySort'
66663
+ - $ref: '#/components/parameters/QueryPageCursor'
66664
+ - $ref: '#/components/parameters/QueryPageLimit'
66665
+ responses:
66666
+ '200':
66667
+ content:
66668
+ application/json:
66669
+ schema:
66670
+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66671
+ description: OK
66672
+ '400':
66673
+ $ref: '#/components/responses/BadRequestResponse'
66674
+ '403':
66675
+ $ref: '#/components/responses/NotAuthorizedResponse'
66676
+ '404':
66677
+ $ref: '#/components/responses/NotFoundResponse'
66678
+ '429':
66679
+ $ref: '#/components/responses/TooManyRequestsResponse'
66680
+ security:
66681
+ - apiKeyAuth: []
66682
+ appKeyAuth: []
66683
+ - AuthZ:
66684
+ - security_monitoring_signals_read
66685
+ summary: List hist signals
66686
+ tags:
66687
+ - Security Monitoring
66688
+ x-permission:
66689
+ operator: OR
66690
+ permissions:
66691
+ - security_monitoring_signals_read
66692
+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66693
+
66694
+ Please check the documentation regularly for updates.'
66695
+ /api/v2/siem-historical-detections/histsignals/search:
66696
+ get:
66697
+ description: Search hist signals.
66698
+ operationId: SearchSecurityMonitoringHistsignals
66699
+ requestBody:
66700
+ content:
66701
+ application/json:
66702
+ schema:
66703
+ $ref: '#/components/schemas/SecurityMonitoringSignalListRequest'
66704
+ required: false
66705
+ responses:
66706
+ '200':
66707
+ content:
66708
+ application/json:
66709
+ schema:
66710
+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66711
+ description: OK
66712
+ '400':
66713
+ $ref: '#/components/responses/BadRequestResponse'
66714
+ '403':
66715
+ $ref: '#/components/responses/NotAuthorizedResponse'
66716
+ '404':
66717
+ $ref: '#/components/responses/NotFoundResponse'
66718
+ '429':
66719
+ $ref: '#/components/responses/TooManyRequestsResponse'
66720
+ security:
66721
+ - apiKeyAuth: []
66722
+ appKeyAuth: []
66723
+ - AuthZ:
66724
+ - security_monitoring_signals_read
66725
+ summary: Search hist signals
66726
+ tags:
66727
+ - Security Monitoring
66728
+ x-permission:
66729
+ operator: OR
66730
+ permissions:
66731
+ - security_monitoring_signals_read
66732
+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66733
+
66734
+ Please check the documentation regularly for updates.'
66735
+ /api/v2/siem-historical-detections/histsignals/{histsignal_id}:
66736
+ get:
66737
+ description: Get a hist signal's details.
66738
+ operationId: GetSecurityMonitoringHistsignal
66739
+ parameters:
66740
+ - $ref: '#/components/parameters/HistoricalSignalID'
66741
+ responses:
66742
+ '200':
66743
+ content:
66744
+ application/json:
66745
+ schema:
66746
+ $ref: '#/components/schemas/SecurityMonitoringSignalResponse'
66747
+ description: OK
66748
+ '400':
66749
+ $ref: '#/components/responses/BadRequestResponse'
66750
+ '403':
66751
+ $ref: '#/components/responses/NotAuthorizedResponse'
66752
+ '404':
66753
+ $ref: '#/components/responses/NotFoundResponse'
66754
+ '429':
66755
+ $ref: '#/components/responses/TooManyRequestsResponse'
66756
+ security:
66757
+ - apiKeyAuth: []
66758
+ appKeyAuth: []
66759
+ - AuthZ:
66760
+ - security_monitoring_signals_read
66761
+ summary: Get a hist signal's details
66762
+ tags:
66763
+ - Security Monitoring
66764
+ x-permission:
66765
+ operator: OR
66766
+ permissions:
66767
+ - security_monitoring_signals_read
66768
+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66769
+
66770
+ Please check the documentation regularly for updates.'
66635
66771
/api/v2/siem-historical-detections/jobs:
66636
66772
get:
66637
66773
description: List historical jobs.
@@ -66853,6 +66989,48 @@ paths:
66853
66989
- security_monitoring_rules_write
66854
66990
x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66855
66991
66992
+ Please check the documentation regularly for updates.'
66993
+ /api/v2/siem-historical-detections/jobs/{job_id}/histsignals:
66994
+ get:
66995
+ description: Get a job's hist signals.
66996
+ operationId: GetSecurityMonitoringHistsignalsByJobId
66997
+ parameters:
66998
+ - $ref: '#/components/parameters/HistoricalJobID'
66999
+ - $ref: '#/components/parameters/QueryFilterSearch'
67000
+ - $ref: '#/components/parameters/QueryFilterFrom'
67001
+ - $ref: '#/components/parameters/QueryFilterTo'
67002
+ - $ref: '#/components/parameters/QuerySort'
67003
+ - $ref: '#/components/parameters/QueryPageCursor'
67004
+ - $ref: '#/components/parameters/QueryPageLimit'
67005
+ responses:
67006
+ '200':
67007
+ content:
67008
+ application/json:
67009
+ schema:
67010
+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
67011
+ description: OK
67012
+ '400':
67013
+ $ref: '#/components/responses/BadRequestResponse'
67014
+ '403':
67015
+ $ref: '#/components/responses/NotAuthorizedResponse'
67016
+ '404':
67017
+ $ref: '#/components/responses/NotFoundResponse'
67018
+ '429':
67019
+ $ref: '#/components/responses/TooManyRequestsResponse'
67020
+ security:
67021
+ - apiKeyAuth: []
67022
+ appKeyAuth: []
67023
+ - AuthZ:
67024
+ - security_monitoring_signals_read
67025
+ summary: Get a job's hist signals
67026
+ tags:
67027
+ - Security Monitoring
67028
+ x-permission:
67029
+ operator: OR
67030
+ permissions:
67031
+ - security_monitoring_signals_read
67032
+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
67033
+
66856
67034
Please check the documentation regularly for updates.'
66857
67035
/api/v2/slo/report:
66858
67036
post:
0 commit comments