SOS Findings Events

SOS Findings Events is a platform for managing, tracking, and resolving security incidents and findings across enterprise environments.

SOS Findings Events is a comprehensive security findings and incident management platform designed to centralize, enrich, and track security events across cloud and on-premises environments. This connector enables Swimlane Turbine users to automate the ingestion, enrichment, correlation, and lifecycle management of security findings and incidents, including vulnerability and compliance data. By integrating with SOS Findings Events, security teams can streamline incident response, enhance context around findings, and orchestrate end-to-end workflows without manual intervention. The result is improved visibility, faster remediation, and more effective security operations through low-code automation.

Prerequisites

None

Actions

Enrichment Finding

Enrich a specific finding in SOS Findings Events with additional context and details using the enrichment_finding input.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
enrichment_finding	object	Required	Parameter for Enrichment Finding
enrichment_finding.activity_name	string	Required	The event activity name, as defined by the activity_id.
enrichment_finding.attacks	array	Optional	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
enrichment_finding.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
enrichment_finding.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
enrichment_finding.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
enrichment_finding.attacks.technique	object	Required	The attack technique.
enrichment_finding.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
enrichment_finding.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
enrichment_finding.attacks.version	string	Required	The ATT&CK Matrix version.
enrichment_finding.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
enrichment_finding.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
enrichment_finding.cloud.account_type	string	Optional	The user account type, as defined by the event source.
enrichment_finding.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
enrichment_finding.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
enrichment_finding.cloud.project_uid	string	Optional	Cloud project identifier.
enrichment_finding.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
enrichment_finding.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
enrichment_finding.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
enrichment_finding.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
enrichment_finding.compliance	object	Optional	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
enrichment_finding.compliance.requirements	array	Optional	A list of applicable compliance requirements for which this finding is related to.
enrichment_finding.compliance.status	string	Optional	The event status, as reported by the event source.
enrichment_finding.compliance.status_detail	string	Optional	The status details contains additional information about the event outcome.
enrichment_finding.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.

Input Example

{"enrichment_finding":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[{"name":"Example Name","type":"string"}],"modified_time_dt":"string","product_uid":"string","related_events":{},"remediation":{"desc":"string","kb_articles":["string"]},"rules":[{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}],"src_url":"string","supporting_data":[],"title":"string","types":["string"],"uid":"string"},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"organization":{"data":{},"name":"Example Name","sectors":["string"],"uid":"string"},"raw_data":"string","resources":[{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"Example Name","labels":["string"],"name":"Example Name","owner":"string","region":"string","software_inventory":[{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"}],"type":"string","uid":"string","unmapped":{}}],"severity":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","unmapped":{},"vulnerabilities":[{"cve":{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"},"desc":"string","kb_articles":["string"],"packages":[{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}],"references":["string"],"related_vulnerabilities":["string"],"severity":"string","title":"string","vendor_name":"Example Name"}]}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Enrichment Finding .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
compliance	object	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
compliance.requirements	array	A list of applicable compliance requirements for which this finding is related to.
compliance.status	string	The event status, as reported by the event source.
compliance.status_detail	string	The status details contains additional information about the event outcome.

Output Example

{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"s...

Incident Associate

Associate a specified entity with an incident in SOS Findings Events using the provided incident_associate input.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
incident_associate	object	Required	Unique identifier
incident_associate.activity_name	string	Required	The event activity name, as defined by the activity_id.
incident_associate.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
incident_associate.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
incident_associate.cloud.account_type	string	Optional	The user account type, as defined by the event source.
incident_associate.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
incident_associate.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
incident_associate.cloud.project_uid	string	Optional	Cloud project identifier.
incident_associate.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
incident_associate.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
incident_associate.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
incident_associate.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
incident_associate.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
incident_associate.correlation_uid	string	Required	The identifier of the event that is associated with the incident.
incident_associate.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
incident_associate.data	object	Optional	Additional data that is associated with the event.
incident_associate.duration	integer	Optional	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
incident_associate.end_time_dt	string	Optional	The end time of a time period, or the time of the most recent event included in the aggregate event.
incident_associate.enrichments	array	Optional	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
incident_associate.enrichments.data	object	Required	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
incident_associate.enrichments.name	string	Optional	The name of the attribute to which the enriched data pertains.
incident_associate.enrichments.provider	string	Optional	The enrichment data provider name.
incident_associate.enrichments.type	string	Optional	The enrichment type. For example: location
incident_associate.enrichments.value	object	Optional	The value of the attribute to which the enriched data pertains.
incident_associate.incident_uid	string	Required	The incident unique identifier.

Input Example

{"incident_associate":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"correlation_uid":"string","count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Incident Associate .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
correlation_uid	string	The identifier of the event that is associated with the incident.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.
duration	integer	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
end_time_dt	string	The end time of a time period, or the time of the most recent event included in the aggregate event.
enrichments	array	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
enrichments.data	object	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
enrichments.name	string	The name of the attribute to which the enriched data pertains.
enrichments.provider	string	The enrichment data provider name.
enrichments.type	string	The enrichment type. For example: location
enrichments.value	object	The value of the attribute to which the enriched data pertains.

Output Example

{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"correlation_uid":"string","count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string...

Incident Closure

Close an incident in the SOS Findings Events platform by providing the required incident_close input.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
incident_close	object	Required	Unique identifier
incident_close.activity_name	string	Required	The event activity name, as defined by the activity_id.
incident_close.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
incident_close.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
incident_close.cloud.account_type	string	Optional	The user account type, as defined by the event source.
incident_close.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
incident_close.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
incident_close.cloud.project_uid	string	Optional	Cloud project identifier.
incident_close.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
incident_close.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
incident_close.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
incident_close.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
incident_close.comment	string	Optional	The user-provided comment.
incident_close.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
incident_close.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
incident_close.data	object	Optional	Additional data that is associated with the event.
incident_close.duration	integer	Optional	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
incident_close.end_time_dt	string	Optional	The end time of a time period, or the time of the most recent event included in the aggregate event.
incident_close.enrichments	array	Optional	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
incident_close.enrichments.data	object	Required	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
incident_close.enrichments.name	string	Optional	The name of the attribute to which the enriched data pertains.
incident_close.enrichments.provider	string	Optional	The enrichment data provider name.
incident_close.enrichments.type	string	Optional	The enrichment type. For example: location
incident_close.enrichments.value	object	Optional	The value of the attribute to which the enriched data pertains.
incident_close.incident_uid	string	Required	The unique identifier of the incident.

Input Example

{"incident_close":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Incident Closure .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
comment	string	The user-provided comment.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.
duration	integer	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
end_time_dt	string	The end time of a time period, or the time of the most recent event included in the aggregate event.
enrichments	array	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
enrichments.data	object	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
enrichments.name	string	The name of the attribute to which the enriched data pertains.
enrichments.provider	string	The enrichment data provider name.
enrichments.type	string	The enrichment type. For example: location
enrichments.value	object	The value of the attribute to which the enriched data pertains.

Output Example

{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logg...

Incident Creation

Initiate a new incident in SOS Findings Events using specified details and receive the created incident information.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
incident_create	object	Required	Unique identifier
incident_create.activity_name	string	Required	The event activity name, as defined by the activity_id.
incident_create.assignee	string	Optional	The name of the user who is assigned to the incident.
incident_create.attacks	array	Optional	An array of attacks associated with an event.
incident_create.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
incident_create.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
incident_create.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
incident_create.attacks.technique	object	Required	The attack technique.
incident_create.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
incident_create.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
incident_create.attacks.version	string	Required	The ATT&CK Matrix version.
incident_create.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
incident_create.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
incident_create.cloud.account_type	string	Optional	The user account type, as defined by the event source.
incident_create.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
incident_create.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
incident_create.cloud.project_uid	string	Optional	Cloud project identifier.
incident_create.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
incident_create.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
incident_create.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
incident_create.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
incident_create.comment	string	Optional	The user-provided comment.
incident_create.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
incident_create.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
incident_create.creator_name	string	Optional	The name of the user who created the incident.

Input Example

{"incident_create":{"activity_name":"Example Name","assignee":"string","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"creator_name":"Example Name","data":{},"desc":"string","duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
assignee	string	The name of the user who is assigned to the incident.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Incident Creation .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
comment	string	The user-provided comment.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.

Output Example

{"activity_name":"string","assignee":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"creator_name":"string","data":{},"desc":"string","duration":123,"end_time_dt":"string","enrichments":[]}

Incident Update

Update an existing incident in SOS Findings Events with the provided incident details.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
incident_update	object	Required	Unique identifier
incident_update.activity_name	string	Required	The event activity name, as defined by the activity_id.
incident_update.assignee	string	Optional	The name of the user who is assigned to the incident.
incident_update.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
incident_update.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
incident_update.cloud.account_type	string	Optional	The user account type, as defined by the event source.
incident_update.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
incident_update.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
incident_update.cloud.project_uid	string	Optional	Cloud project identifier.
incident_update.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
incident_update.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
incident_update.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
incident_update.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
incident_update.comment	string	Optional	The user-provided comment.
incident_update.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
incident_update.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
incident_update.data	object	Optional	The additional data that is associated with the incident.
incident_update.duration	integer	Optional	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
incident_update.end_time_dt	string	Optional	The end time of a time period, or the time of the most recent event included in the aggregate event.
incident_update.enrichments	array	Optional	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
incident_update.enrichments.data	object	Required	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
incident_update.enrichments.name	string	Optional	The name of the attribute to which the enriched data pertains.
incident_update.enrichments.provider	string	Optional	The enrichment data provider name.
incident_update.enrichments.type	string	Optional	The enrichment type. For example: location
incident_update.enrichments.value	object	Optional	The value of the attribute to which the enriched data pertains.

Input Example

{"incident_update":{"activity_name":"Example Name","assignee":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"modified_time_dt":"string","modifier":"string","observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
assignee	string	The name of the user who is assigned to the incident.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Incident Update .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
comment	string	The user-provided comment.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	The additional data that is associated with the incident.
duration	integer	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
end_time_dt	string	The end time of a time period, or the time of the most recent event included in the aggregate event.
enrichments	array	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
enrichments.data	object	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
enrichments.name	string	The name of the attribute to which the enriched data pertains.
enrichments.provider	string	The enrichment data provider name.
enrichments.type	string	The enrichment type. For example: location

Output Example

{"activity_name":"string","assignee":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labe...

Reported Finding

Submit a reported finding to SOS Findings Events for processing and tracking by providing the required finding details.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
reported_finding	object	Required	Parameter for Reported Finding
reported_finding.activity_name	string	Required	The event activity name, as defined by the activity_id.
reported_finding.attacks	array	Optional	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
reported_finding.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
reported_finding.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
reported_finding.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
reported_finding.attacks.technique	object	Required	The attack technique.
reported_finding.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
reported_finding.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
reported_finding.attacks.version	string	Required	The ATT&CK Matrix version.
reported_finding.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
reported_finding.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
reported_finding.cloud.account_type	string	Optional	The user account type, as defined by the event source.
reported_finding.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
reported_finding.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
reported_finding.cloud.project_uid	string	Optional	Cloud project identifier.
reported_finding.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
reported_finding.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
reported_finding.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
reported_finding.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
reported_finding.compliance	object	Optional	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
reported_finding.compliance.requirements	array	Optional	A list of applicable compliance requirements for which this finding is related to.
reported_finding.compliance.status	string	Optional	The event status, as reported by the event source.
reported_finding.compliance.status_detail	string	Optional	The status details contains additional information about the event outcome.
reported_finding.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.

Input Example

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Reported Finding .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
compliance	object	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
compliance.requirements	array	A list of applicable compliance requirements for which this finding is related to.
compliance.status	string	The event status, as reported by the event source.
compliance.status_detail	string	The status details contains additional information about the event outcome.

Output Example

{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"finding":{"created_time_dt":...

Security Finding

Retrieve detailed information about a specific security finding in SOS Findings Events using the provided identifier.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
security_finding	object	Required	Parameter for Security Finding
security_finding.activity_name	string	Required	The event activity name, as defined by the activity_id.
security_finding.attacks	array	Optional	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
security_finding.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
security_finding.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
security_finding.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
security_finding.attacks.technique	object	Required	The attack technique.
security_finding.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
security_finding.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
security_finding.attacks.version	string	Required	The ATT&CK Matrix version.
security_finding.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
security_finding.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
security_finding.cloud.account_type	string	Optional	The user account type, as defined by the event source.
security_finding.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
security_finding.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
security_finding.cloud.project_uid	string	Optional	Cloud project identifier.
security_finding.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
security_finding.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
security_finding.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
security_finding.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
security_finding.compliance	object	Optional	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
security_finding.compliance.requirements	array	Optional	A list of applicable compliance requirements for which this finding is related to.
security_finding.compliance.status	string	Optional	The event status, as reported by the event source.
security_finding.compliance.status_detail	string	Optional	The status details contains additional information about the event outcome.
security_finding.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.

Input Example

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	The attack object describes the technique and associated tactics as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Findings .
class_name	string	The event class name, as defined by class_uid value: Security Finding .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
compliance	object	The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details.
compliance.requirements	array	A list of applicable compliance requirements for which this finding is related to.
compliance.status	string	The event status, as reported by the event source.
compliance.status_detail	string	The status details contains additional information about the event outcome.

Output Example

{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"finding":{"created_time_dt":...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT