Gets a list of riskware alerts in summary format. The response is in chronological order. The list can be filtered by specifying the search attributes. If no attributes are passed, a sorted (starting from the oldest) list of alerts is returned based on their last modified status time.
POST https://<etp-instance>/api/v1/alerts/riskware
Required headers:
Content-Type: "application/json"—Content type of the request body.
If the domain you use you use to access the Trellix UI ends in fireeye.com:
x-fireeye-api-key: <key>—Specifies your personal API key.
If the domain you use to access the Trellix UI ends in trellix.com:
authorization: bearer <access_token>—Specifies your personal access token.
Important
Use
authorization: bearer <access_token>in place ofx-fireeye-api-key: <key>in the following examples.
Options
from_LastModifiedOn—(string) Date time in yyyy-mm-ddThh:mm:ss.fff format in reverse chronological order. Default: last 90 days.
size—(integer) Number of alerts to include in response. Valid range: 1-200. Default: 20.
Parameters:
etp_message_id—(string) Email message ID.email_status—(array of strings) Can be:quarantinedreleaseddeletedbcc:droppeddelivered (retroactive)dropped (oob retroactive)
riskware_rules—(array of strings) riskware rules the email matched.read—(boolean) whether the alert is read or not.acknowledged—(boolean) whether the alert is acknowledged or not.
Example of the request
Values for ID and other fields are for illustration only.
Example of message ID:
POST https://<APIURI>/alerts/riskware -H "Content-Type: application/json" -H 'x-fireeye-api-key: <APIKEY>' -d '{"size": 2,"attributes": {"etp_message_id": "3yPqa1e-381-11BA7604406CFC17F464c4a0eac"}}'
Example of Riskware Rule ID:
POST https://<APIURI>/alerts/riskware -H "Content-Type: application/json" -H 'x-fireeye-api-key: <APIKEY>' -d '{"size": 2, "attributes": {"riskware_rules": ["65001","65000"]}}'
Example of email status:
POST https://<APIURI>/alerts/riskware -H "Content-Type: application/json" -H 'x-fireeye-api-key: <APIKEY>' -d '{"fromLastModifiedOn": "2023-11-07T01:14:13.325", "attributes": {"email_status":["quarantined", "ACE: Passthrough"]}, "size":100}'
Example of the response
{
"data": [
{
"attributes": {
"meta": {
"read": false,
"last_modified_on": "2023-10-11T10:28:09.708",
"legacy_id": 73977,
"acknowledged": false,
"timestamps": {
"db_insert_time": "2023-10-11T10:28:09.638952+00",
"es_insert_time": "2023-10-11T10:28:09.708"
},
"last_malware": "CustomPolicy.MVX.65025.FileWithInconsistentMagicAndExtension.",
"alert_type": "riskware",
"file_type": "dual"
},
"ati": {},
"alert": {
"product": "ETP",
"alert_type": [
"rw"
],
"riskware_md5": "76fa78cba057940fe64845c425d5db3b",
"original": "PDF raccordo A14-sp253R.rar",
"timestamp": "2023-10-11T10:28:09.708",
"sha256": "08a8327a05719c27cd332648261393c127b38e4d955868c89b3d3884325c9d78",
"riskware_rules": [
"65025",
"65003"
]
},
"email": {
"status": "quarantined",
"source_ip": "209.135.212.252",
"smtp": {
"rcpt_to": "usera@swayamqatest.etp-testdomain5.com",
"mail_from": "dev_testing@bp.etp-testdomain5.com"
},
"etp_message_id": "3yPuBIR-1123361-q1602D06866A1876256c458cd40",
"headers": {
"cc": "",
"to": "usera@swayamqatest.etp-testdomain5.com",
"from": "dev_testing@bp.etp-testdomain5.com",
"subject": "CustomPolicy_MVX_65025_FileWithInconsistentMagicAndExtension.eml*"
},
"attachment": "PDF raccordo A14-sp253R.rar",
"timestamp": {
"accepted": "2023-10-11T10:25:30"
}
}
},
"id": "3yPuBIR-1123361-5f364ed8-c0c6-4b07-962d-14f0449704e0",
"links": {
"detail": "/api/v1/alerts/riskware/3yPuBIR-1123361-5f364ed8-c0c6-4b07-962d-14f0449704e0"
},
"customer_id": "30572"
},
{
"attributes": {
"meta": {
"read": false,
"last_modified_on": "2023-10-11T10:28:14.110",
"legacy_id": 73978,
"acknowledged": false,
"timestamps": {
"db_insert_time": "2023-10-11T10:28:14.026547+00",
"es_insert_time": "2023-10-11T10:28:14.110"
},
"last_malware": "CustomPolicy.MVX.65025.FileWithInconsistentMagicAndExtension.",
"alert_type": "riskware",
"file_type": "pdf"
},
"ati": {},
"alert": {
"product": "ETP",
"alert_type": [
"rw"
],
"riskware_md5": "7caf0e277735c8f7fbb7c093718b6129",
"original": "RACCORDO TRA S.P.253R E A14-5- sol.3 COROGRAFIA.pdf",
"timestamp": "2023-10-11T10:28:14.109",
"sha256": "e715dbdfd1f7ddcf7451f44e075ddfa735cf6cf048f2d8e4bb4ec2c142dc3d75",
"riskware_rules": [
"65025"
]
},
"email": {
"status": "quarantined",
"source_ip": "209.135.212.252",
"smtp": {
"rcpt_to": "usera@swayamqatest.etp-testdomain5.com",
"mail_from": "dev_testing@bp.etp-testdomain5.com"
},
"etp_message_id": "3yPuBIR-1123361-q1602D06866A1876256c458cd40",
"headers": {
"cc": "",
"to": "usera@swayamqatest.etp-testdomain5.com",
"from": "dev_testing@bp.etp-testdomain5.com",
"subject": "CustomPolicy_MVX_65025_FileWithInconsistentMagicAndExtension.eml*"
},
"attachment": "RACCORDO TRA S.P.253R E A14-5- sol.3 COROGRAFIA.pdf",
"timestamp": {
"accepted": "2023-10-11T10:25:30"
}
}
},
"id": "3yPuBIR-1123361-c45c746d-a56b-4bfd-ab59-b499cc601fdb",
"links": {
"detail": "/api/v1/alerts/riskware/3yPuBIR-1123361-c45c746d-a56b-4bfd-ab59-b499cc601fdb"
},
"customer_id": "30572"
}
],
"meta": {
"total": 156,
"size": 2,
"fromLastModifiedOn": {
"start": "2023-10-11T10:28:09.708",
"end": "2023-10-11T10:28:14.110"
},
"copyright": "Copyright © 2023 Musarubra US LLC"
},
"type": "riskware alerts"
}