--- title: SOS Findings Events slug: connectors/sos-findings-events docTags: createdAt: 2026-06-09T16:29:47.450Z --- SOS Findings Events is a platform for managing, tracking, and resolving security incidents and findings across enterprise environments. SOS Findings Events is a comprehensive security findings and incident management platform designed to centralize, enrich, and track security events across cloud and on-premises environments. This connector enables Swimlane Turbine users to automate the ingestion, enrichment, correlation, and lifecycle management of security findings and incidents, including vulnerability and compliance data. By integrating with SOS Findings Events, security teams can streamline incident response, enhance context around findings, and orchestrate end-to-end workflows without manual intervention. The result is improved visibility, faster remediation, and more effective security operations through low-code automation. ## Prerequisites None # Actions ## Enrichment Finding Enrich a specific finding in SOS Findings Events with additional context and details using the enrichment\_finding input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `enrichment_finding` | object | Required | Parameter for Enrichment Finding | | `enrichment_finding.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `enrichment_finding.attacks` | array | Optional | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `enrichment_finding.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `enrichment_finding.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `enrichment_finding.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `enrichment_finding.attacks.technique` | object | Required | The attack technique. | | `enrichment_finding.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `enrichment_finding.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `enrichment_finding.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `enrichment_finding.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `enrichment_finding.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `enrichment_finding.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `enrichment_finding.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `enrichment_finding.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `enrichment_finding.cloud.project_uid` | string | Optional | Cloud project identifier. | | `enrichment_finding.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `enrichment_finding.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `enrichment_finding.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `enrichment_finding.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `enrichment_finding.compliance` | object | Optional | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `enrichment_finding.compliance.requirements` | array | Optional | A list of applicable compliance requirements for which this finding is related to. | | `enrichment_finding.compliance.status` | string | Optional | The event status, as reported by the event source. | | `enrichment_finding.compliance.status_detail` | string | Optional | The status details contains additional information about the event outcome. | | `enrichment_finding.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | ### Input Example `{"enrichment_finding":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[{"name":"Example Name","type":"string"}],"modified_time_dt":"string","product_uid":"string","related_events":{},"remediation":{"desc":"string","kb_articles":["string"]},"rules":[{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}],"src_url":"string","supporting_data":[],"title":"string","types":["string"],"uid":"string"},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"organization":{"data":{},"name":"Example Name","sectors":["string"],"uid":"string"},"raw_data":"string","resources":[{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"Example Name","labels":["string"],"name":"Example Name","owner":"string","region":"string","software_inventory":[{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"}],"type":"string","uid":"string","unmapped":{}}],"severity":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","unmapped":{},"vulnerabilities":[{"cve":{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"},"desc":"string","kb_articles":["string"],"packages":[{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}],"references":["string"],"related_vulnerabilities":["string"],"severity":"string","title":"string","vendor_name":"Example Name"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Enrichment Finding.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `compliance` | object | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `compliance.requirements` | array | A list of applicable compliance requirements for which this finding is related to. | | `compliance.status` | string | The event status, as reported by the event source. | | `compliance.status_detail` | string | The status details contains additional information about the event outcome. | ### Output Example `{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"s...` ## Incident Associate Associate a specified entity with an incident in SOS Findings Events using the provided incident\_associate input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `incident_associate` | object | Required | Unique identifier | | `incident_associate.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `incident_associate.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `incident_associate.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `incident_associate.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `incident_associate.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `incident_associate.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `incident_associate.cloud.project_uid` | string | Optional | Cloud project identifier. | | `incident_associate.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `incident_associate.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `incident_associate.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `incident_associate.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `incident_associate.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `incident_associate.correlation_uid` | string | Required | The identifier of the event that is associated with the incident. | | `incident_associate.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `incident_associate.data` | object | Optional | Additional data that is associated with the event. | | `incident_associate.duration` | integer | Optional | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `incident_associate.end_time_dt` | string | Optional | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `incident_associate.enrichments` | array | Optional | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `incident_associate.enrichments.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `incident_associate.enrichments.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `incident_associate.enrichments.provider` | string | Optional | The enrichment data provider name. | | `incident_associate.enrichments.type` | string | Optional | The enrichment type. For example: location | | `incident_associate.enrichments.value` | object | Optional | The value of the attribute to which the enriched data pertains. | | `incident_associate.incident_uid` | string | Required | The incident unique identifier. | ### Input Example `{"incident_associate":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"correlation_uid":"string","count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Incident Associate.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `correlation_uid` | string | The identifier of the event that is associated with the incident. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | Additional data that is associated with the event. | | `duration` | integer | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `end_time_dt` | string | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `enrichments` | array | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `enrichments.data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `enrichments.name` | string | The name of the attribute to which the enriched data pertains. | | `enrichments.provider` | string | The enrichment data provider name. | | `enrichments.type` | string | The enrichment type. For example: location | | `enrichments.value` | object | The value of the attribute to which the enriched data pertains. | ### Output Example `{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"correlation_uid":"string","count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string...` ## Incident Closure Close an incident in the SOS Findings Events platform by providing the required incident\_close input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `incident_close` | object | Required | Unique identifier | | `incident_close.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `incident_close.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `incident_close.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `incident_close.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `incident_close.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `incident_close.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `incident_close.cloud.project_uid` | string | Optional | Cloud project identifier. | | `incident_close.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `incident_close.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `incident_close.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `incident_close.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `incident_close.comment` | string | Optional | The user-provided comment. | | `incident_close.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `incident_close.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `incident_close.data` | object | Optional | Additional data that is associated with the event. | | `incident_close.duration` | integer | Optional | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `incident_close.end_time_dt` | string | Optional | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `incident_close.enrichments` | array | Optional | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `incident_close.enrichments.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `incident_close.enrichments.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `incident_close.enrichments.provider` | string | Optional | The enrichment data provider name. | | `incident_close.enrichments.type` | string | Optional | The enrichment type. For example: location | | `incident_close.enrichments.value` | object | Optional | The value of the attribute to which the enriched data pertains. | | `incident_close.incident_uid` | string | Required | The unique identifier of the incident. | ### Input Example `{"incident_close":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Incident Closure.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `comment` | string | The user-provided comment. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | Additional data that is associated with the event. | | `duration` | integer | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `end_time_dt` | string | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `enrichments` | array | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `enrichments.data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `enrichments.name` | string | The name of the attribute to which the enriched data pertains. | | `enrichments.provider` | string | The enrichment data provider name. | | `enrichments.type` | string | The enrichment type. For example: location | | `enrichments.value` | object | The value of the attribute to which the enriched data pertains. | ### Output Example `{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logg...` ## Incident Creation Initiate a new incident in SOS Findings Events using specified details and receive the created incident information. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `incident_create` | object | Required | Unique identifier | | `incident_create.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `incident_create.assignee` | string | Optional | The name of the user who is assigned to the incident. | | `incident_create.attacks` | array | Optional | An array of attacks associated with an event. | | `incident_create.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `incident_create.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `incident_create.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `incident_create.attacks.technique` | object | Required | The attack technique. | | `incident_create.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `incident_create.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `incident_create.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `incident_create.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `incident_create.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `incident_create.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `incident_create.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `incident_create.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `incident_create.cloud.project_uid` | string | Optional | Cloud project identifier. | | `incident_create.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `incident_create.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `incident_create.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `incident_create.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `incident_create.comment` | string | Optional | The user-provided comment. | | `incident_create.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `incident_create.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `incident_create.creator_name` | string | Optional | The name of the user who created the incident. | ### Input Example `{"incident_create":{"activity_name":"Example Name","assignee":"string","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"creator_name":"Example Name","data":{},"desc":"string","duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `assignee` | string | The name of the user who is assigned to the incident. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Incident Creation.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `comment` | string | The user-provided comment. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| ### Output Example `{"activity_name":"string","assignee":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"creator_name":"string","data":{},"desc":"string","duration":123,"end_time_dt":"string","enrichments":[]}` ## Incident Update Update an existing incident in SOS Findings Events with the provided incident details. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `incident_update` | object | Required | Unique identifier | | `incident_update.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `incident_update.assignee` | string | Optional | The name of the user who is assigned to the incident. | | `incident_update.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `incident_update.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `incident_update.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `incident_update.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `incident_update.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `incident_update.cloud.project_uid` | string | Optional | Cloud project identifier. | | `incident_update.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `incident_update.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `incident_update.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `incident_update.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `incident_update.comment` | string | Optional | The user-provided comment. | | `incident_update.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `incident_update.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `incident_update.data` | object | Optional | The additional data that is associated with the incident. | | `incident_update.duration` | integer | Optional | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `incident_update.end_time_dt` | string | Optional | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `incident_update.enrichments` | array | Optional | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `incident_update.enrichments.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `incident_update.enrichments.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `incident_update.enrichments.provider` | string | Optional | The enrichment data provider name. | | `incident_update.enrichments.type` | string | Optional | The enrichment type. For example: location | | `incident_update.enrichments.value` | object | Optional | The value of the attribute to which the enriched data pertains. | ### Input Example `{"incident_update":{"activity_name":"Example Name","assignee":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"modified_time_dt":"string","modifier":"string","observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"priority":123,"raw_data":"string","rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"},"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `assignee` | string | The name of the user who is assigned to the incident. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Incident Update.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `comment` | string | The user-provided comment. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | The additional data that is associated with the incident. | | `duration` | integer | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `end_time_dt` | string | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `enrichments` | array | The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers:
:::Iframe{code=""} :::
\[\{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": \{"city": "Socotra", "continent": "Asia", "coordinates": \[-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]

| | `enrichments.data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `enrichments.name` | string | The name of the attribute to which the enriched data pertains. | | `enrichments.provider` | string | The enrichment data provider name. | | `enrichments.type` | string | The enrichment type. For example: location | ### Output Example `{"activity_name":"string","assignee":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"comment":"string","confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"incident_uid":"string","message":"string","metadata":{"correlation_uid":"string","labe...` ## Reported Finding Submit a reported finding to SOS Findings Events for processing and tracking by providing the required finding details. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `reported_finding` | object | Required | Parameter for Reported Finding | | `reported_finding.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `reported_finding.attacks` | array | Optional | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `reported_finding.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `reported_finding.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `reported_finding.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `reported_finding.attacks.technique` | object | Required | The attack technique. | | `reported_finding.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `reported_finding.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `reported_finding.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `reported_finding.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `reported_finding.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `reported_finding.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `reported_finding.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `reported_finding.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `reported_finding.cloud.project_uid` | string | Optional | Cloud project identifier. | | `reported_finding.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `reported_finding.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `reported_finding.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `reported_finding.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `reported_finding.compliance` | object | Optional | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `reported_finding.compliance.requirements` | array | Optional | A list of applicable compliance requirements for which this finding is related to. | | `reported_finding.compliance.status` | string | Optional | The event status, as reported by the event source. | | `reported_finding.compliance.status_detail` | string | Optional | The status details contains additional information about the event outcome. | | `reported_finding.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | ### Input Example `{"reported_finding":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[{"name":"Example Name","type":"string"}],"modified_time_dt":"string","product_uid":"string","related_events":{},"remediation":{"desc":"string","kb_articles":["string"]},"rules":[{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}],"src_url":"string","supporting_data":[],"title":"string","types":["string"],"uid":"string"},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"organization":{"data":{},"name":"Example Name","sectors":["string"],"uid":"string"},"process":{"cmd_line":"string","created_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{},"security_descriptor":"string","signature":{},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{"cmd_line":"string","created_time_dt":"string","file":{},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{},"xattributes":{}},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"xattributes":{}},"raw_data":"string","reporter":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"resources":[{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"Example Name","labels":["string"],"name":"Example Name","owner":"string","region":"string","software_inventory":[{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"}],"type":"string","uid":"string","unmapped":{}}],"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{},"vulnerabilities":[{"cve":{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"},"desc":"string","kb_articles":["string"],"packages":[{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}],"references":["string"],"related_vulnerabilities":["string"],"severity":"string","title":"string","vendor_name":"Example Name"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Reported Finding.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `compliance` | object | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `compliance.requirements` | array | A list of applicable compliance requirements for which this finding is related to. | | `compliance.status` | string | The event status, as reported by the event source. | | `compliance.status_detail` | string | The status details contains additional information about the event outcome. | ### Output Example `{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"finding":{"created_time_dt":...` ## Security Finding Retrieve detailed information about a specific security finding in SOS Findings Events using the provided identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `security_finding` | object | Required | Parameter for Security Finding | | `security_finding.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `security_finding.attacks` | array | Optional | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `security_finding.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `security_finding.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `security_finding.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `security_finding.attacks.technique` | object | Required | The attack technique. | | `security_finding.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `security_finding.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `security_finding.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `security_finding.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `security_finding.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `security_finding.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `security_finding.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `security_finding.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `security_finding.cloud.project_uid` | string | Optional | Cloud project identifier. | | `security_finding.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `security_finding.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `security_finding.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `security_finding.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `security_finding.compliance` | object | Optional | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `security_finding.compliance.requirements` | array | Optional | A list of applicable compliance requirements for which this finding is related to. | | `security_finding.compliance.status` | string | Optional | The event status, as reported by the event source. | | `security_finding.compliance.status_detail` | string | Optional | The status details contains additional information about the event outcome. | | `security_finding.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | ### Input Example `{"security_finding":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[{"name":"Example Name","type":"string"}],"modified_time_dt":"string","product_uid":"string","related_events":{},"remediation":{"desc":"string","kb_articles":["string"]},"rules":[{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}],"src_url":"string","supporting_data":[],"title":"string","types":["string"],"uid":"string"},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"organization":{"data":{},"name":"Example Name","sectors":["string"],"uid":"string"},"process":{"cmd_line":"string","created_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{},"security_descriptor":"string","signature":{},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{"cmd_line":"string","created_time_dt":"string","file":{},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{},"xattributes":{}},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"xattributes":{}},"raw_data":"string","resources":[{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"Example Name","labels":["string"],"name":"Example Name","owner":"string","region":"string","software_inventory":[{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"}],"type":"string","uid":"string","unmapped":{}}],"severity":"string","start_time_dt":"string","state":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{},"vulnerabilities":[{"cve":{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"},"desc":"string","kb_articles":["string"],"packages":[{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}],"references":["string"],"related_vulnerabilities":["string"],"severity":"string","title":"string","vendor_name":"Example Name"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | The attack object describes the technique and associated tactics as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Findings.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Security Finding.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `compliance` | object | The complaince object provides context to compliance findings (e.g., a check against a specific regulatory or best practice framework such as CIS or NIST) and contains compliance related details. | | `compliance.requirements` | array | A list of applicable compliance requirements for which this finding is related to. | | `compliance.status` | string | The event status, as reported by the event source. | | `compliance.status_detail` | string | The status details contains additional information about the event outcome. | ### Output Example `{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"compliance":{"requirements":["string"],"status":"active","status_detail":"active"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"finding":{"created_time_dt":...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |