Devo Api
The Devo platform is a cloud-based data analytics platform that allows you to collect, analyze, and visualize large volumes of data from various sources.
Devo is a data analytics platform that provides real-time insights and analytics for large volumes of data.
Devo is a real-time security analytics platform that provides comprehensive visibility and insights into security events. The Devo API connector allows Swimlane Turbine users to seamlessly integrate Devo's capabilities, enabling automated retrieval of alerts and execution of queries within specified time ranges. This integration enhances the efficiency of security operations by automating data collection and analysis, allowing users to focus on critical threat response activities.
Prerequisites
Before you can use the Devo API connector for Turbine, you'll need access to the Devo API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint for accessing the Devo API.
- Authentication Token: A token used to authenticate API requests.
- and HTTP Bearer authorization using the following parameters:
- URL: The endpoint for accessing the Devo API.
- Token: A bearer token used for OAuth authentication.
Asset
You can generate a token in the Administration β Credentials area of Devo to authorize your request.
Capabilities
- Query Action
- Get Alerts
Notes
For more details, please refer to the Devo API Documentation Link
Additional Documentation
Configurations
Devo API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host.URL - https://api-us.devo.com | string | Required |
standAloneToken | Authentication Token | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
HTTP Bearer Authentication
Authenticates using bearer OAuth token
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. IE https://apiv2-us.devo.com | string | Required |
token | The API Token | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get Alerts
Obtain a list of triggered alerts within a specified time range from Devo API, with options to limit and offset results.
Endpoint
- URL: alerts/v1/alerts/list
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.limit | number | Required | Maximum number of elements returned in the response. |
parameters.offset | number | Required | Position of the first element in the returned list. You will retrieve a subset of records starting with the offset value. Enter 0 if you don't want to specify a subset. |
parameters.from | number | Required | Filters all alerts triggered after this date. This must by an epoch time in milliseconds. |
parameters.to | number | Required | Filters all alerts triggered before this date. This must by an epoch time in milliseconds. |
parameters.orderby | string | Optional | Order the alerts by a specific field. |
parameters.orderasc | boolean | Optional | Set this parameter to true to retrieve the alert list in ascending order. |
parameters.showAll | boolean | Optional | Set this parameter to true to retrieve all the triggered alerts, including the ones with false positive and closed status. The default value is false. |
Input Example
{"parameters":{"limit":10,"offset":0,"from":1654008600000,"to":1654008900000,"orderby":"id","orderasc":true,"showAll":true}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
Output Example
{"status_code":200,"reason":"OK","headers":{},"json_body":[{"id":0,"domain":"string","priority":0,"context":"string","category":"string","srcPort":0,"srcIp":"string","srcHost":"string","dstIp":"string","dstPort":0,"dstHost":"string","protocol":"string","username":"string","application":"string","engine":"string"}]}
Get Query
Run a specified query within the Devo platform using a time range defined by 'from' and 'to' parameters.
Endpoint
- URL: /search/query
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
query | string | Optional | Parameter for Get Query |
queryId | string | Optional | Unique identifier |
from | string | Optional | Parameter for Get Query |
to | string | Optional | Parameter for Get Query |
mode | string | Optional | Parameter for Get Query |
dateFormat | string | Optional | Parameter for Get Query |
timeZone | string | Optional | Parameter for Get Query |
offset | number | Optional | Parameter for Get Query |
skip | number | Optional | Parameter for Get Query |
limit | number | Optional | Parameter for Get Query |
ipAsString | boolean | Optional | Parameter for Get Query |
vaultName | string | Optional | Name of the resource |
progressInfo | boolean | Optional | Parameter for Get Query |
allowPartialResults | boolean | Optional | Result of the operation |
keepAlive | string | Optional | Parameter for Get Query |
Input Example
{"json_body":{"query":"from demo.ecommerce.data select *","queryId":"query-1","from":"1h","to":"now","mode":"json","dateFormat":"default","timeZone":"GMT-1","offset":1,"skip":1,"limit":100,"ipAsString":true,"vaultName":"low","progressInfo":false,"allowPartialResults":false,"keepAlive":"empty"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
headers | object | HTTP headers for the request |
details | object | Output field: details |
details.status | number | Status value |
details.cid | string | Unique identifier |
details.timestamp | number | Output field: details.timestamp |
details.msg | string | Output field: details.msg |
details.object | array | Output field: details.object |
details.object.eventdate | string | Date value |
details.object.host | string | Output field: details.object.host |
details.object.memory_heap_used | string | Output field: details.object.memory_heap_used |
details.object.memory_non_heap_used | string | Output field: details.object.memory_non_heap_used |
Output Example
{"status_code":200,"reason":"Ok","headers":null,"details":{"status":0,"cid":"ue7bt8PFMN","timestamp":1528308389081,"msg":"","object":[{},{},{}]}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |