None. The URI specifies the query.
Response
The information that is returned is a JSON dictionary with the following keys
Key | Notes |
|---|---|
data | A one element list for the inquired row, where the element is a key-value dictionary with a key for each field listed in the Valid Fields, above. |
Key | Notes |
|---|---|
query | The ID of the event requested |
{
"data": [
{
"id": 1,
"md5": "fec3360f7a614480f461936ffa28053a",
"agent_id": "as1fmN5D81ebiO1pyEAwIe",
"event_at": "2023-05-08T17:08:36.298Z",
"process_file_exists": true,
"process_path": "/bin/bash",
"pid": 64162,
"parent_path": "/Library/FireEye/xagt/xagt.app/Contents/MacOS/xagt",
"parent_pid": 64143,
"file_size": 1326576,
"file_created_at": "2022-05-26T03:00:45.000Z",
"file_last_accessed_at": "2022-05-26T03:00:45.000Z",
"file_last_modified_at": "2022-05-26T03:00:45.000Z",
"args": null,
"type": "end",
"started_at": "2023-05-08T17:08:36.298Z",
"user": "root",
"owner": "root",
"is_signed": null,
"file_attributes": null,
"alerted_at": null,
"process_file_cert": null,
"signature_verified": null,
"last_status_change_time": "2022-05-26T03:00:45.000Z",
"group": "wheel",
"created_at": "2023-05-08T17:08:37.618Z",
"updated_at": "2023-05-08T17:08:37.618Z",
"is_prelinked": null,
"uuid": "bb132546-c721-469d-9f09-09151185d545",
"enrichment_status": null,
"enrichment_requested_at": null,
"hostname": "mac-177.eng.fireeye.com"
}
],
"query": {
"id": 1
}
}