Fetch execution ID API

Use this API to fetch the execution_id for the system events return API.

POST https://<API_HOST>/api/v1/systemevents/search

Required headers:

Content-Type: application/json—Content-type of the request body.

x-fireeye-api-key: <key>—Specifies your personal API key.

Request body:

'{
   "log_type": "log_type",
   "dt": {
       "from":"yyyy-mm-dd",
       "to":"yyyy-mm-dd"},
}'

Request body fields:

None of the parameters are mandatory. Any combination of parameters can be given.

log_type—(string) Can be:
- GET_AUTH
- GSUITE_GMAIL_SERVICE
- GSUITE_ADMIN_SERVICE
- GSUITE_STOP
- GSUITE_WATCH
- GSUITE_LIST_USERS
- MS_LIST_USERS
- MS_DELETE_SUBSCRIPTION
- MS_UPDATE_SUBSCRIPTION
- MS_CREATE_SUBSCRIPTION
dt—(object) date range from and to.
- If no date range is specified, results for the current day are returned.
- Date range cannot exceed 7 days.

Example request

'{
   "log_type": "GET_AUTH",
   "dt": {
       "from":"2023-06-21",
       "to":"2023-06-25"},
}'

Example response

{
    "data": {
      "execution_id": "831968ec-8064-4d4b-8ec6-d351055a6377"
    },  
    "meta": {
      "type": "System Events",
      "copyright": "Copyright 2023 Trellix"  
    }
}

cURL code sample: fetch execution ID

curl -X POST https://<API_HOST>/api/v1/systemevents/search -H 'Content-Type: application/json' -H 'x-fireeye-api-key: xxxxxxxxxxxxxxx' -d '{"log_type": "MS_UPDATE_SUBSCRIPTION", "dt": {"from":"2023-04-27", "to":"2023-04-28"}}'

This cURL sample includes the following options:

-X POST—This option changes the HTTP method to POST.
https://<API_HOST>/api/v1/systemevents/search —The system events request URL. Replace <API_Host> with the address of your Email Security — Cloud instance.
-H 'Content-Type: application/json'—This header specifies that the server's response body is expected to be in JSON format.
-H 'x-fireeye-api-key: xxxxxxxxxxxxxxx'—This header specifies your personal API key.
-d '{<data>}'—The request parameters.