Sos Minimal Event

This connector can be used to build a minimal SOS-compliant generic event

Prerequisites

None

Actions

Minimal Base Event

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
minimal_base_event	object	Required	Parameter for Minimal Base Event
minimal_base_event.activity_name	string	Required	The event activity name, as defined by the activity_id.
minimal_base_event.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
minimal_base_event.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
minimal_base_event.cloud.account_type	string	Optional	The user account type, as defined by the event source.
minimal_base_event.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
minimal_base_event.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
minimal_base_event.cloud.project_uid	string	Optional	Cloud project identifier.
minimal_base_event.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
minimal_base_event.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
minimal_base_event.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
minimal_base_event.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
minimal_base_event.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
minimal_base_event.data	object	Optional	Additional data that is associated with the event.
minimal_base_event.duration	integer	Optional	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
minimal_base_event.end_time_dt	string	Optional	The end time of a time period, or the time of the most recent event included in the aggregate event.
minimal_base_event.enrichments	array	Optional	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
minimal_base_event.enrichments.data	object	Required	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
minimal_base_event.enrichments.name	string	Optional	The name of the attribute to which the enriched data pertains.
minimal_base_event.enrichments.provider	string	Optional	The enrichment data provider name.
minimal_base_event.enrichments.type	string	Optional	The enrichment type. For example: location
minimal_base_event.enrichments.value	object	Optional	The value of the attribute to which the enriched data pertains.
minimal_base_event.message	string	Optional	The description of the event, as defined by the event source.
minimal_base_event.metadata	object	Required	The metadata associated with the event.
minimal_base_event.metadata.correlation_uid	string	Optional	The unique identifier used to correlate events.

Input Example

{"minimal_base_event":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","start_time_dt":"string","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
category_name	string	The event category name, as defined by category_uid value: Generic Event .
class_name	string	The event class name, as defined by class_uid value: Minimal Base Event .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.
duration	integer	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
end_time_dt	string	The end time of a time period, or the time of the most recent event included in the aggregate event.
enrichments	array	The additional information from an external data source, which is associated with the event. For example add location information for the IP address in the DNS answers: [{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
enrichments.data	object	The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record.
enrichments.name	string	The name of the attribute to which the enriched data pertains.
enrichments.provider	string	The enrichment data provider name.
enrichments.type	string	The enrichment type. For example: location
enrichments.value	object	The value of the attribute to which the enriched data pertains.
message	string	The description of the event, as defined by the event source.
metadata	object	The metadata associated with the event.

Output Example

{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"count":123,"data":{},"duration":123,"end_time_dt":"string","enrichments":[],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_t...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT