Parameter | Notes |
|---|---|
limit=<unsigned 32> | Limits the number of records returned. The default is 50. |
offset=<unsigned 32> | Used for pagination. Returns the records starting with this offset. Default is 0. |
sort=<text> | Sorts the result by the specified field and direction. Default is id:ascending. Valid fields: agent_id, alerted_at, args, enrichment_requested_at, enrichment_status, event_at, file_attributes, file_created_at, file_last_accessed_at, file_last_modified_at, file_size, group, hostname, id, is_prelinked, is_signed, last_status_change_time, md5, owner, parent_path, parent_pid, pid, process_file_cert, process_file_exists, process_path, signature_verified, started_at, type, user, uuid Valid directions: |
filter=<filter spec list> | Specifies how to filter the events. The Default is no filter. A filter spec is declared with the following keys and values: {
“operator”:”eq”,
“field”:”file_size”,
“arg”:[30000]
}Where field is any of the listed Valid Fields above, arg is the value(s) to match against. Valid values for operator are:
A complex filter can contain more than one filter spec as follows: filter=[{filter spec 1},{filter spec 2},…] where the implied operation between filter specs is AND |
Response
The information that is returned is a JSON dictionary with the following keys.
Key | Notes |
|---|---|
total | Number of data rows (events) available. |
data | List of rows, each as a key-value dictionary with a key for each field listed in the Valid Fields in the previous table. |
offset | The offset requested. |
limit | The limit requested. |
filter | The filter requested. |
sort | The sort requested. |
{
"total": 150,
"data": [
{
"id": 1,
"md5": "fec3360f7a614480f461936ffa28053a",
"agent_id": "as1fmN5D81ebiO1pyEAwIe",
"event_at": "2023-05-08T17:08:36.298Z",
"process_file_exists": true,
"process_path": "/bin/bash",
"pid": 64162,
"parent_path": "/Library/FireEye/xagt/xagt.app/Contents/MacOS/xagt",
"parent_pid": 64143,
"file_size": 1326576,
"file_created_at": "2022-05-26T03:00:45.000Z",
"file_last_accessed_at": "2022-05-26T03:00:45.000Z",
"file_last_modified_at": "2022-05-26T03:00:45.000Z",
"args": null,
"type": "end",
"started_at": "2023-05-08T17:08:36.298Z",
"user": "root",
"owner": "root",
"is_signed": null,
"file_attributes": null,
"alerted_at": null,
"process_file_cert": null,
"signature_verified": null,
"last_status_change_time": "2022-05-26T03:00:45.000Z",
"group": "wheel",
"created_at": "2023-05-08T17:08:37.618Z",
"updated_at": "2023-05-08T17:08:37.618Z",
"is_prelinked": null,
"uuid": "bb132546-c721-469d-9f09-09151185d545",
"enrichment_status": null,
"enrichment_requested_at": null,
"hostname": "mac-177.eng.fireeye.com"
}
],
"offset": 0,
"limit": 1,
"filter": [
{
"field": "md5",
"arg": [
""
],
"operator": "contains"
}
],
"sort": [
{
"created_at": "asc"
},
{
"id": "ascending"
}
]
}