Microsoft Cloud Apps
Microsoft Cloud Apps is a cloud-based service that helps organizations manage and secure their applications across various platforms.
Microsoft Cloud Apps is a comprehensive cloud security solution that helps organizations protect their data and applications across multiple cloud services. This connector enables seamless integration with Swimlane Turbine, allowing users to automate security management tasks such as alert handling, IP address range management, and entity retrieval. By leveraging this integration, Swimlane Turbine end-users can enhance their security operations with efficient automation, reducing manual effort and improving response times to potential threats.
Prerequisites
Before you can use the Microsoft Cloud Apps connector for Turbine, you'll need access to the Microsoft Cloud Apps API. This requires the following:
- OAuth 2.0 Client Credentials authentication using the following parameters:
- URL: The endpoint for accessing Microsoft Cloud Apps services.
- Client ID: The unique identifier for your application.
- Client Secret: The secret key associated with your client ID.
- Token URL: The URL used to obtain the access token.
- Scope: The permissions required for accessing specific resources.
- API Key authentication using the following parameters:
- URL: The endpoint for accessing Microsoft Cloud Apps services.
- Access Token: The token used to authenticate API requests.
Capabilities
This connector provides the following capabilities:
- Close Benign
- Close False Positive
- Close True Positive
- Create IP Address Range
- Fetch Alert
- Fetch Entity
- Fetch Entity Tree
- Fetch File
- Generate Block Script
- Initiate File Upload
- List Alerts
- List Continuous Report Category
- List Continuous Reports
- List Entities
- List Files ... and so on
Close Benign
For input reasonId, Click here to check possible values
Close False Positive
For input reasonId, Click here to check possible values
Create IP Address Range
For input category, Click here to check possible values
Fetch Entity
The input entity_id is a dictionary with the entity ID, SaaS, and instance details encoded as a base64 string. For example: {"id":"3fa9f28b-eb0e-463a-ba7b-8089fe9991e2","saas":11161,"inst":0} encoded as a base64 string.
Generate Block Script
For input format, following formats are currently supported:
Appliance | Format |
|---|---|
BlueCoat ProxySG | 102 |
Cisco ASA | 104 |
Fortinet FortiGate | 108 |
Juniper SRX | 129 |
Palo Alto | 112 |
Websense | 135 |
Zscaler | 120 |
Initiate File Upload
For input source, click here to check supported source type
List Alerts
For input filters see alert filters for more details.
List Entities
For input sortField , choose from following values
- displayName
- score
For input filters see entities filer for more details.
List Files
For input filters see file filters for more details.
List IP Ranges
For input filters see IP Range filters for more details.
The input sortField is used to sort IP ranges. Possible values are:
- category
- tags
- name
Manage IP Address Range
For input filters see Data Enrichment filters for more details.
Update IP Address Range
The input category, is the id of the range category. Providing a category helps you easily recognize activities from interesting IP addresses. Possible values include:
- 1: Corporate
- 2: Administrative
- 3: Risky
- 4: VPN
- 5: Cloud provider
- 6: Other
Notes
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
access_token | Access Token | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | Must start with https://login.microsoftonline.com/ and then continue with the tenant_id, and then be prepended with /oauth2/v2.0/token | string | Required |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
scope | List of permission scopes for this action. | array | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Close Benign
Close multiple alerts in Microsoft Cloud Apps as benign based on specified filters.
Endpoint
- URL: /api/v1/alerts/close_benign/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for Close Benign |
comment | string | Optional | Parameter for Close Benign |
reasonId | number | Optional | Unique identifier |
sendFeedback | boolean | Optional | Parameter for Close Benign |
feedbackText | string | Optional | Parameter for Close Benign |
allowContact | boolean | Optional | Parameter for Close Benign |
contactEmail | string | Optional | Parameter for Close Benign |
Input Example
{"json_body":{"filters":{},"comment":"Irrelevant","reasonId":5,"sendFeedback":true,"feedbackText":"Feedback text","allowContact":true,"contactEmail":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
closed_benign | number | Output field: closed_benign |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:34:52 GMT","Content-Type":"application/json","Content-Length":"20","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"cadb6340-0767-4a0b-b6e...
Close False Positive
Close multiple alerts in Microsoft Cloud Apps as false positives based on specified filters.
Endpoint
- URL: /api/v1/alerts/close_false_positive/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for Close False Positive |
comment | string | Optional | Parameter for Close False Positive |
reasonId | number | Optional | Unique identifier |
sendFeedback | boolean | Optional | Parameter for Close False Positive |
feedbackText | string | Optional | Parameter for Close False Positive |
allowContact | boolean | Optional | Parameter for Close False Positive |
contactEmail | string | Optional | Parameter for Close False Positive |
Input Example
{"json_body":{"filters":{},"comment":"Irrelevant","reasonId":0,"sendFeedback":true,"feedbackText":"Feedback text","allowContact":true,"contactEmail":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
closed_false_positive | number | Output field: closed_false_positive |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:46:02 GMT","Content-Type":"application/json","Content-Length":"28","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtuale...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"0d9ae7f9-6ae5-4aa3-88f...
Close True Positive
Close multiple alerts in Microsoft Cloud Apps as true positives based on specified filters.
Endpoint
- URL: /api/v1/alerts/close_true_positive/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for Close True Positive |
comment | string | Optional | Parameter for Close True Positive |
sendFeedback | boolean | Optional | Parameter for Close True Positive |
feedbackText | string | Optional | Parameter for Close True Positive |
allowContact | boolean | Optional | Parameter for Close True Positive |
contactEmail | string | Optional | Parameter for Close True Positive |
Input Example
{"json_body":{"filters":{},"comment":"Irrelevant","sendFeedback":true,"feedbackText":"Feedback text","allowContact":true,"contactEmail":""}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
closed_true_positive | number | Output field: closed_true_positive |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:46:58 GMT","Content-Type":"application/json","Content-Length":"27","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"03c75f53-d5b8-4d3e-bb8...
Create IP Address Range
Run a POST request to add a new IP address range in Microsoft Cloud Apps using the specified name and subnets.
Endpoint
- URL: /api/v1/subnet/create_rule/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | Name of the resource |
category | number | Optional | Parameter for Create IP Address Range |
organization | string | Optional | Parameter for Create IP Address Range |
subnets | array | Optional | Parameter for Create IP Address Range |
tags | array | Optional | Parameter for Create IP Address Range |
Input Example
{"json_body":{"name":"range name","category":5,"organization":"Microsoft","subnets":["192.168.1.0/24","192.168.2.0/16"],"tags":["existing tag"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 13:00:23 GMT","Content-Type":"application/json","Content-Length":"26","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtualearth.net cdn.cloudap...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"0d231409-732d-4d3e-8c0...
Delete IP Address Range
Run a DELETE request to remove an IP address range in Microsoft Cloud Apps using the ip_range_id path parameter.
Endpoint
- URL: /api/v1/subnet/{{ip_range_id}}/
- Method: DELETE
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.ip_range_id | string | Required | Parameters for the Delete IP Address Range action |
Input Example
{"path_parameters":{"ip_range_id":"64d23c67d0b71bb8e300b276"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
response_text | string | Output field: response_text |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 13:17:28 GMT","Content-Length":"0","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"d980baba-a243-43f0-a1ed-d8...
Fetch Alert
Retrieve an alert from Microsoft Cloud Apps using the specified alert ID as the primary key.
Endpoint
- URL: /api/v1/alerts/{{alert_id}}/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert_id | string | Required | Parameters for the Fetch Alert action |
Input Example
{"path_parameters":{"alert_id":"603f704aaf7417985bbf3b22"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
_id | string | Unique identifier |
contextId | string | Unique identifier |
description | string | Output field: description |
entities | array | Output field: entities |
entities.entityRole | string | Output field: entities.entityRole |
entities.entityType | number | Type of the resource |
entities.id | string | Unique identifier |
entities.inst | number | Output field: entities.inst |
entities.label | string | Output field: entities.label |
entities.pa | string | Output field: entities.pa |
entities.saas | number | Output field: entities.saas |
entities.type | string | Type of the resource |
entities.policyType | string | Type of the resource |
idValue | number | Unique identifier |
isSystemAlert | boolean | Output field: isSystemAlert |
resolutionStatusValue | number | Status value |
severityValue | number | Value for the parameter |
statusValue | number | Status value |
stories | array | Output field: stories |
threatScore | number | Score value |
timestamp | number | Output field: timestamp |
title | string | Output field: title |
comment | string | Output field: comment |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:25:08 GMT","Content-Type":"application/json","Content-Length":"30","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","requ...
Fetch Entity
Run a GET request to retrieve an entity in Microsoft Cloud Apps using the specified primary key, entity_id.
Endpoint
- URL: /api/v1/entities/{{entity_id}}/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.entity_id | string | Required | Parameters for the Fetch Entity action |
Input Example
{"path_parameters":{"entity_id":"eyJpZCI6IjY3OGY4MGU1LWU1MDYtNGYxMC04OTVkLWJmNjY0Njk5NDc1ZCIsInNhYXMiOjExMTYxLCJpbnN0IjowfQ=="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
type | number | Type of the resource |
status | number | Status value |
displayName | string | Name of the resource |
id | string | Unique identifier |
_id | string | Unique identifier |
userGroups | array | Output field: userGroups |
userGroups._id | string | Unique identifier |
userGroups.id | string | Unique identifier |
userGroups.name | string | Name of the resource |
userGroups.description | string | Output field: userGroups.description |
userGroups.usersCount | number | Count value |
identifiers | array | Unique identifier |
identifiers.type | number | Unique identifier |
identifiers.status | number | Unique identifier |
identifiers.displayName | string | Unique identifier |
sid | object | Unique identifier |
appData | object | Response data |
appData.appId | number | Response data |
appData.name | string | Response data |
appData.saas | number | Response data |
appData.instance | number | Response data |
isAdmin | boolean | Output field: isAdmin |
isExternal | boolean | Output field: isExternal |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 13:36:40 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtuale...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-stor...
Fetch Entity Tree
Run a GET request to retrieve all entities related to the specified entity ID in Microsoft Cloud Apps.
Endpoint
- URL: /api/v1/entities/{{entity_id}}/retrieve_tree/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.entity_id | string | Required | A dictionary with the entity ID, SaaS, and inst details encoded as a base64 string. |
Input Example
{"path_parameters":{"entity_id":"eyJpZCI6IjY3OGY4MGU1LWU1MDYtNGYxMC04OTVkLWJmNjY0Njk5NDc1ZCIsInNhYXMiOjExMTYxLCJpbnN0IjowfQ=="}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.type | number | Response data |
data.status | number | Response data |
data.displayName | string | Response data |
data.id | string | Response data |
data._id | string | Response data |
data.userGroups | array | Response data |
data.userGroups.file_name | string | Response data |
data.userGroups.file | string | Response data |
data.identifiers | array | Response data |
data.identifiers.type | number | Response data |
data.identifiers.status | number | Response data |
data.identifiers.displayName | string | Response data |
data.sid | object | Response data |
data.appData | object | Response data |
data.appData.appId | number | Response data |
data.appData.name | string | Response data |
data.appData.saas | number | Response data |
data.appData.instance | number | Response data |
data.isAdmin | boolean | Response data |
data.isExternal | boolean | Response data |
data.email | string | Response data |
data.role | string | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 06:35:49 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, HEAD, OPTIONS","Content-Security-Policy":"font-src 'self' *.s-microsoft.com c.s-microsoft.com flow.microsoft.com data: cdn...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"d283a942-...
Fetch File
Retrieve a file from Microsoft Cloud Apps using the specified file ID as the primary key.
Endpoint
- URL: /api/v1/files/{{file_id}}/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.file_id | string | Required | Parameters for the Fetch File action |
Input Example
{"path_parameters":{"file_id":"603f704aaf7417985bbf3b22"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:27:20 GMT","Content-Type":"application/json","Content-Length":"30","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"frame-src 'self' *.us2.portal.cloudappsecurity.com; img-src 'self' 'self' data: ...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","requ...
Generate Block Script
Run a GET request to obtain a block script for your network appliance in Microsoft Cloud Apps.
Endpoint
- URL: /api/discovery_block_scripts/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.format | number | Optional | Parameters for the Generate Block Script action |
Input Example
{"parameters":{"format":102}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data._id | string | Response data |
data.appId | number | Response data |
data.domainList | array | Response data |
data.name | string | Response data |
data.security | object | Response data |
data.security.MFA | object | Response data |
data.security.adminAuditTrail | object | Response data |
data.security.anonymous_usage | object | Response data |
data.security.cert | object | Response data |
data.security.cert.badCommonName | object | Response data |
data.security.cert.hostnameMismatch | object | Response data |
data.security.cert.insecureSignature | object | Response data |
data.security.cert.isBlacklisted | object | Response data |
data.security.cert.isRevoked | object | Response data |
data.security.cert.noChainOfTrust | object | Response data |
data.security.cert.notAfter | object | Response data |
data.security.cert.notBefore | object | Response data |
data.security.cert.selfSigned | object | Response data |
data.security.certIsTrusted | boolean | Response data |
data.security.dataAuditTrail | object | Response data |
data.security.dataClassification | object | Response data |
data.security.dataEncrypted | object | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 10:08:34 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"font-src 'self' *.s-microsoft.com c.s-microsoft.com flow.microsoft.com data: cdn...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"322...
Initiate File Upload
Run the GET request to initiate the file upload process in Microsoft Cloud Apps using the specified filename.
Endpoint
- URL: /api/v1/discovery/upload_url/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.filename | string | Required | Parameters for the Initiate File Upload action |
parameters.source | string | Optional | Parameters for the Initiate File Upload action |
Input Example
{"parameters":{"filename":"my_discovery_file.txt","source":"GENERIC_CEF"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
url | string | URL endpoint for the request |
provider | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 07 Aug 2023 09:26:53 GMT","Content-Type":"application/json","Content-Length":"258","Connection":"keep-alive","Allow":"GET, OPTIONS","Vary":"Origin, Cookie","Content-Security-Policy":"font-src 'self' *.s-microsoft.com c.s-microsoft.com flow.microsoft.com data: cdn...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"70a94534-d0d1-4dc6-a83b-6448d7...
List Alerts
Fetch a list of alerts from Microsoft Cloud Apps that match the specified filters.
Endpoint
- URL: /api/v1/alerts/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for List Alerts |
sortDirection | string | Optional | Parameter for List Alerts |
sortField | string | Optional | Parameter for List Alerts |
skip | number | Optional | Parameter for List Alerts |
limit | number | Optional | Parameter for List Alerts |
Input Example
{"json_body":{"filters":{},"sortDirection":"asc","sortField":"severity","skip":5,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data._id | string | Response data |
data.contextId | string | Response data |
data.description | string | Response data |
data.entities | array | Response data |
data.entities.id | string | Response data |
data.entities.label | string | Response data |
data.entities.policyType | string | Response data |
data.entities.type | string | Response data |
data.entities.em | string | Response data |
data.entities.entityType | number | Response data |
data.entities.inst | number | Response data |
data.entities.pa | string | Response data |
data.entities.saas | number | Response data |
data.evidence | array | Response data |
data.evidence.title | object | Response data |
data.evidence.title.template | string | Response data |
data.evidence.title.parameters.mitre | object | Parameters for the List Alerts action |
data.evidence.title.parameters.tactic | string | Parameters for the List Alerts action |
data.idValue | number | Response data |
data.intent | array | Response data |
data.isSystemAlert | boolean | Response data |
data.resolutionStatusValue | number | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:32:02 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtuale...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"5bf...
List Continuous Report Categories
Run a POST request to retrieve categories linked to a continuous report in Microsoft Cloud Apps. Requires streamId in the JSON body.
Endpoint
- URL: /api/v1/discovery/discovered_apps/categories/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for List Continuous Report Categories |
filters.id | object | Optional | Unique identifier |
filters.id.eq | array | Optional | Unique identifier |
filters.sortDirection | string | Optional | Parameter for List Continuous Report Categories |
filters.sortField | string | Optional | Parameter for List Continuous Report Categories |
filters.skip | number | Optional | Parameter for List Continuous Report Categories |
filters.limit | number | Optional | Parameter for List Continuous Report Categories |
filters.streamId | string | Optional | Unique identifier |
filters.timeFrame | string | Optional | Parameter for List Continuous Report Categories |
Input Example
{"json_body":{"filters":{"id":{"eq":["64499022ab22621e53dd7865"]},"sortDirection":"asc","sortField":"score","skip":5,"limit":10,"streamId":"64499022ab22621e53dd7865","timeFrame":"7"}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.id | string | Response data |
data.total | number | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 07 Aug 2023 11:29:56 GMT","Content-Type":"application/json","Content-Length":"665","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"frame-src 'self' *.us2.portal.cloudappsecurity.com; img-src 'self' 'self' data: ...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"8242cc19-b920-4890-88...
List Continuous Reports
Run a GET request to retrieve a list of continuous reports in Microsoft Cloud Apps.
Endpoint
- URL: api/discovery/streams/
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Data Body |
headers | object | Optional | Request Headers |
Input Example
{"path_parameters":{},"parameters":{},"data_body":{},"headers":{}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
streams | array | Output field: streams |
streams._id | string | Unique identifier |
streams.logType | number | Type of the resource |
streams.builtInStreamType | number | Type of the resource |
streams.displayName | string | Name of the resource |
streams.streamType | number | Type of the resource |
streams.snapshotData | boolean | Response data |
streams.created | string | Output field: streams.created |
streams.isManual | boolean | Output field: streams.isManual |
streams.canUpdateMasterStream | boolean | Output field: streams.canUpdateMasterStream |
streams.supportedTrafficTypes | array | Type of the resource |
streams.supportedTrafficTypes.file_name | string | Name of the resource |
streams.supportedTrafficTypes.file | string | Type of the resource |
streams.supportedEntityTypes | array | Type of the resource |
streams.supportedEntityTypes.file_name | string | Name of the resource |
streams.supportedEntityTypes.file | string | Type of the resource |
streams.lastModified | string | Output field: streams.lastModified |
streams.receiverType | string | Type of the resource |
streams._tid | number | Unique identifier |
streams.lastDataReceived | string | Response data |
streams.logFilesHistoryCount | number | Count value |
streams.currentServicesCollectionName | string | Name of the resource |
streams.globalAggregated | boolean | Output field: streams.globalAggregated |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 07 Aug 2023 11:17:03 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Allow":"OPTIONS, GET","Vary":"Origin, Cookie","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"ab1cd0dd-f15d-4cec-b4c8...
List Entities
Fetch a list of entities in Microsoft Cloud Apps using specified filters via a POST request.
Endpoint
- URL: /api/v1/entities/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for List Entities |
sortDirection | string | Optional | Parameter for List Entities |
sortField | string | Optional | Parameter for List Entities |
skip | number | Optional | Parameter for List Entities |
limit | number | Optional | Parameter for List Entities |
Input Example
{"json_body":{"filters":{},"sortDirection":"asc","sortField":"displayName","skip":5,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.type | number | Response data |
data.status | number | Response data |
data.displayName | string | Response data |
data.id | string | Response data |
data._id | string | Response data |
data.userGroups | array | Response data |
data.userGroups._id | string | Response data |
data.userGroups.id | string | Response data |
data.userGroups.name | string | Response data |
data.userGroups.description | string | Response data |
data.userGroups.usersCount | number | Response data |
data.identifiers | array | Response data |
data.identifiers.file_name | string | Response data |
data.identifiers.file | string | Response data |
data.sid | object | Response data |
data.appData | object | Response data |
data.appData.appId | number | Response data |
data.appData.name | string | Response data |
data.appData.saas | number | Response data |
data.appData.instance | number | Response data |
data.isAdmin | boolean | Response data |
data.isExternal | boolean | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 13:28:05 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtuale...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"42f...
List Files
Post a request to retrieve a list of files in Microsoft Cloud Apps that match specified filters.
Endpoint
- URL: /api/v1/files/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for List Files |
skip | number | Optional | Parameter for List Files |
limit | number | Optional | Parameter for List Files |
Input Example
{"json_body":{"filters":{},"skip":5,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.file_name | string | Response data |
data.file | string | Response data |
hasNext | boolean | Output field: hasNext |
max | number | Output field: max |
total | number | Output field: total |
moreThanTotal | boolean | Output field: moreThanTotal |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 07:04:30 GMT","Content-Type":"application/json","Content-Length":"69","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"font-src 'self' *.s-microsoft.com c.s-microsoft.com flow.microsoft.com data: cdn...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"344f5d14-b0...
List IP Ranges
Request to fetch a list of IP ranges matching the specified filters in Microsoft Cloud Apps.
Endpoint
- URL: /api/v1/subnet/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for List IP Ranges |
sortDirection | string | Optional | Parameter for List IP Ranges |
sortField | string | Optional | Parameter for List IP Ranges |
skip | number | Optional | Parameter for List IP Ranges |
limit | number | Optional | Parameter for List IP Ranges |
Input Example
{"json_body":{"filters":{},"sortDirection":"asc","sortField":"category","skip":5,"limit":10}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data._id | string | Response data |
data.name | string | Response data |
data.subnets | array | Response data |
data.subnets.mask | number | Response data |
data.subnets.address | string | Response data |
data.subnets.originalString | string | Response data |
data.location | object | Response data |
data.location.name | string | Response data |
data.location.latitude | number | Response data |
data.location.longitude | number | Response data |
data.location.countryCode | string | Response data |
data.location.countryName | string | Response data |
data.organization | string | Response data |
data.tags | array | Response data |
data.tags._id | string | Response data |
data.tags.id | string | Response data |
data.tags.target | number | Response data |
data.tags.type | number | Response data |
data.tags.name | string | Response data |
data.tags.nameTemplate | object | Response data |
data.tags.nameTemplate.template | string | Response data |
data.tags.description | string | Response data |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 10:50:54 GMT","Content-Type":"application/json","Content-Length":"37","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtuale...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"0ddaf22f-90...
Manage IP Address Range
Use Data Enrichment APIs to manage IP address ranges in Microsoft Cloud Apps.
Endpoint
- URL: /api/v1/subnet/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filters | object | Optional | Parameter for Manage IP Address Range |
limit | number | Optional | Parameter for Manage IP Address Range |
Input Example
{"json_body":{"filters":{},"limit":5}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data._id | string | Response data |
data.name | string | Response data |
data.subnets | array | Response data |
data.subnets.mask | number | Response data |
data.subnets.address | string | Response data |
data.subnets.originalString | string | Response data |
data.location | object | Response data |
data.organization | object | Response data |
data.tags | array | Response data |
data.tags.file_name | string | Response data |
data.tags.file | string | Response data |
data.category | number | Response data |
data.lastModified | number | Response data |
data._tid | number | Response data |
hasNext | boolean | Output field: hasNext |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 09 Aug 2023 10:25:55 GMT","Content-Type":"application/json","Content-Length":"411","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"3c6cafdf-1...
Mark Alert As Read
Mark a specific alert as read in Microsoft Cloud Apps using the alert_id as the primary key.
Endpoint
- URL: /api/v1/alerts/{{alert_id}}/read/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert_id | string | Required | Parameters for the Mark Alert As Read action |
Input Example
{"path_parameters":{"alert_id":"603f704aaf7417985bbf3b22"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":400,"response_headers":{"Server":"nginx","Date":"Mon, 07 Aug 2023 09:12:15 GMT","Content-Type":"application/json","Content-Length":"140","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"frame-src 'self' *.us2.portal.cloudappsecurity.com; img-src 'self' 'self' data: ...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","req...
Mark Alert As Unread
Mark a specific alert as unread in Microsoft Cloud Apps using the alert_id path parameter.
Endpoint
- URL: /api/v1/alerts/{{alert_id}}/unread/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.alert_id | string | Required | Parameters for the Mark Alert As Unread action |
Input Example
{"path_parameters":{"alert_id":"649cc0f3967076e7d60db283"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":400,"response_headers":{"Server":"nginx","Date":"Mon, 07 Aug 2023 09:18:39 GMT","Content-Type":"application/json","Content-Length":"144","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS","Content-Security-Policy":"default-src 'self'; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloud...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","req...
Update IP Address Range
Run a POST request to update an existing IP address range in Microsoft Cloud Apps using the ip_range_id, name, and subnets.
Endpoint
- URL: /api/v1/subnet/{{ip_range_id}}/update_rule/
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.ip_range_id | string | Required | Parameters for the Update IP Address Range action |
name | string | Optional | Name of the resource |
category | number | Optional | Parameter for Update IP Address Range |
organization | string | Optional | Parameter for Update IP Address Range |
subnets | array | Optional | Parameter for Update IP Address Range |
tags | array | Optional | Parameter for Update IP Address Range |
Input Example
{"json_body":{"name":"range name update","category":5,"organization":"Microsoft","subnets":["192.168.1.0/24","192.168.2.0/16"],"tags":["existing tag"]},"path_parameters":{"ip_range_id":"64d23c67d0b71bb8e300b276"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
name | string | Name of the resource |
subnets | array | Output field: subnets |
subnets.mask | number | Output field: subnets.mask |
subnets.address | string | Output field: subnets.address |
subnets.originalString | string | Output field: subnets.originalString |
location | object | Output field: location |
organization | string | Output field: organization |
tags | array | Output field: tags |
category | number | Output field: category |
lastModified | number | Output field: lastModified |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 08 Aug 2023 13:09:35 GMT","Content-Type":"application/json","Content-Length":"364","Connection":"keep-alive","Vary":"Accept, Origin, Cookie","Allow":"POST, OPTIONS","Content-Security-Policy":"script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtualearth.net cdn.cloudap...","Strict-Transport-Security":"max-age=31536000","X-Content-Type-Options":"nosniff","Cache-Control":"no-cache, no-store","request_id":"7275323d-8fb4-4bc7-9a...
Response Headers
Header | Description | Example |
|---|---|---|
Allow | HTTP response header: Allow | POST, OPTIONS |
Cache-Control | Directives for caching mechanisms | no-cache, no-store |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Length | The length of the response body in bytes | 69 |
Content-Security-Policy | HTTP response header: Content-Security-Policy | font-src 'self' *.s-microsoft.com c.s-microsoft.com flow.microsoft.com data: cdn.cloudappsecurity.com cloudappsecurity-rs.azureedge.net static2.sharepointonline.com portal.cloudappsecurity.com *.portal.cloudappsecurity.com; default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' dev.virtualearth.net cdn.cloudappsecurity.com cloudappsecurity-rs.azureedge.net prodportalmfcdndfl.azureedge.net *.us2.portal.cloudappsecurity.com; img-src 'self' 'self' data: blob: adaproddiscovery.azureedge.net cdn.cloudappsecurity.com cloudappsecurity-rs.azureedge.net prod03use2console1.blob.core.windows.net *.us2.portal.cloudappsecurity.com; frame-src 'self' *.us2.portal.cloudappsecurity.com; connect-src 'self' dc.services.visualstudio.com dev.virtualearth.net cdn.cloudappsecurity.com cloudappsecurity-rs.azureedge.net rs2euwportalreportsxgbr.blob.core.windows.net prod3use2portalreporxaly.blob.core.windows.net prod03use2console1.blob.core.windows.net; style-src 'self' 'unsafe-inline' *.s-microsoft.com cdn.cloudappsecurity.com cloudappsecurity-rs.azureedge.net prodportalmfcdndfl.azureedge.net |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Mon, 07 Aug 2023 09:26:53 GMT |
request_id | HTTP response header: request_id | 680b40c1-2c67-4eb1-bed3-b52991935279 |
Server | Information about the software used by the origin server | nginx |
Set-Cookie | HTTP response header: Set-Cookie | cas_sessionid=9bd4dl481fy2ng72k38okwod3vrv6umn; Domain=.us2.portal.cloudappsecurity.com; expires=Wed, 09 Aug 2023 08:27:20 GMT; HttpOnly; Max-Age=3600; Path=/; Secure |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000 |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
Vary | HTTP response header: Vary | Accept, Origin, Cookie |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |