This API returns a list of system events. Use the execution_id returned in Fetch execution ID API.
GET https://<API_HOST>/api/v1/systemevents/search/<execution_id>
Required headers:
x-fireeye-api-key: <key>—Specifies your personal API key.
Content-Type: application/json—Content-type of the request body.
Parameters
<execution_id>(string)—The execution_id returned in the system event request API.
Example request
https://<API_HOST>/api/v1/systemevents/search/831968ec-8064-4d4b-8ec6-d351055a6377 -H 'content-type:application/json' -H 'x-fireeye-api-key:<api_key>' -o test.csv
Example of query in progress
{
"data": {
"execution_id": "831968ec-8064-4d4b-8ec6-d351055a6377",
"result": "search in progress"
},
"meta": {
"type": "System Events",
"copyright": "Copyright 2023 Trellix"
}
}Example download
Sample Response in test.csv: # log_type datetime refid result domain address msg 1 MS_UPDATE_SUBSCRIPTION 2023-06-21T12:00:04.319Z success etpqa2.com nonadmin1@etpqa2.com Expiration Date: 2023-06-24T00:00:03.237Z 2 MS_UPDATE_SUBSCRIPTION 2023-06-21T08:00:04.769Z success etpqa2.com admin1@etpqa2.com Expiration Date: 2023-06-23T20:00:03.783Z 3 MS_UPDATE_SUBSCRIPTION 2023-06-21T04:00:04.895Z success etpqa2.com nonadmin1@etpqa2.com Expiration Date: 2023-06-23T16:00:03.848Z
cURL code example
curl https://<API_HOST>/api/v1/systemevents/search/831968ec-8064-4d4b-8ec6-d351055a6377 -H 'content-type:application/json' -H 'x-fireeye-api-key:<api_key>' -o test.csv
This cURL sample includes the following options:
https://<API_HOST>/api/v1/systemevents/search/831968ec-8064-4d4b-8ec6-d351055a6377—The system events request URI. Replace <API_Host> with the address of your Email Security — Cloud instance, and 831968ec-8064-4d4b-8ec6-d351055a6377 with your execution ID.-H 'Content-Type: application/json'—This header specifies that the server's response body is expected to be in JSON format.-H 'x-fireeye-api-key: <api_key>'—This header specifies your personal API key.-o <filename.csv>—Filename to which the response will be downloaded