SOS Network Activity Events Pt1

The SOS Network Activity Events Pt1 connector automates the creation of detailed network activity events, streamlining the process of monitoring and responding to network-related security incidents.

SOS Network Activity Events Pt1 is a comprehensive solution for monitoring and responding to network events. This connector enables seamless integration with Swimlane Turbine, allowing users to automate the detection and handling of DHCP, DNS, email, FTP, and HTTP activities. By leveraging this connector, security teams can efficiently track network behavior, identify anomalies, and initiate rapid response actions, enhancing the overall security posture and reducing manual intervention.

Capabilities

Create DHCP Activity events

Create DNS Activity events

Create Email Delivery Activity events

Create Email File Activity events

Create Email URL Activity events

Create FTP Activity events

Create HTTP Activity events

Actions

DHCP Activity

Create a DHCP Activity Event in SOS Network Activity Events Pt1 using the provided activity data.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
dhcp_activity	object	Required	Parameter for DHCP Activity
dhcp_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
dhcp_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
dhcp_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
dhcp_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
dhcp_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
dhcp_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
dhcp_activity.cloud.project_uid	string	Optional	Cloud project identifier.
dhcp_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
dhcp_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
dhcp_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
dhcp_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
dhcp_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
dhcp_activity.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
dhcp_activity.data	object	Optional	Additional data that is associated with the event.
dhcp_activity.duration	integer	Optional	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
dhcp_activity.end_time_dt	string	Optional	The end time of a time period, or the time of the most recent event included in the aggregate event.
dhcp_activity.is_renewal	boolean	Optional	The indication of whether this is a lease/session renewal event.
dhcp_activity.lease_dur	integer	Optional	This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events. (activity_id = 1)
dhcp_activity.message	string	Optional	The description of the event, as defined by the event source.
dhcp_activity.metadata	object	Required	The metadata associated with the event.
dhcp_activity.metadata.correlation_uid	string	Optional	The unique identifier used to correlate events.
dhcp_activity.metadata.labels	array	Optional	The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time. For example: ["network", "connection.ip:destination", "device.ip:source"]
dhcp_activity.metadata.logged_time_dt	string	Optional	The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
dhcp_activity.metadata.modified_time_dt	string	Optional	The time when the event was last modified or enriched.

Input Example

{"dhcp_activity":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","is_renewal":true,"lease_dur":123,"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"network_interface":{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","relay":{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"},"severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"transaction_uid":"string","unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: DHCP Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.
duration	integer	The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
end_time_dt	string	The end time of a time period, or the time of the most recent event included in the aggregate event.
is_renewal	boolean	The indication of whether this is a lease/session renewal event.
lease_dur	integer	This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events. (activity_id = 1)
message	string	The description of the event, as defined by the event source.
metadata	object	The metadata associated with the event.
metadata.correlation_uid	string	The unique identifier used to correlate events.
metadata.labels	array	The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time. For example: ["network", "connection.ip:destination", "device.ip:source"]
metadata.logged_time_dt	string	The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.

Output Example

{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","is_renewal":true,"lease_dur":123,"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modi...

DNS Activity

Create a DNS Activity Event in SOS Network Activity Events Pt1 using the provided DNS activity data.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
dns_activity	object	Required	Parameter for DNS Activity
dns_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
dns_activity.answers	array	Optional	The Domain Name System (DNS) answers.
dns_activity.answers.class	string	Required	The class of DNS data contained in this resource record. See https://www.rfc-editor.org/rfc/rfc1035.txtRFC1035 . For example: IN .
dns_activity.answers.flags	array	Optional	The list of DNS answer header flags.
dns_activity.answers.packet_uid	integer	Optional	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
dns_activity.answers.rdata	string	Required	The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record.
dns_activity.answers.ttl	integer	Optional	The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached.
dns_activity.answers.type	string	Required	The type of data contained in this resource record. See https://www.rfc-editor.org/rfc/rfc1035.txtRFC1035 . For example: CNAME .
dns_activity.app_name	string	Optional	The name of the application that is associated with the event or object.
dns_activity.attacks	array	Optional	An array of attacks associated with an event.
dns_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
dns_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
dns_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
dns_activity.attacks.technique	object	Required	The attack technique.
dns_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
dns_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
dns_activity.attacks.version	string	Required	The ATT&CK Matrix version.
dns_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
dns_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
dns_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
dns_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
dns_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
dns_activity.cloud.project_uid	string	Optional	Cloud project identifier.
dns_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.

Input Example

{"dns_activity":{"activity_name":"Example Name","answers":[{"class":"string","flags":["string"],"packet_uid":123,"rdata":"string","ttl":123,"type":"string"}],"app_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"count":123,"data":{},"disposition":"string","dst_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"duration":123,"end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"proxy":{"hostname":"Example Name","ip":"string","port":123,"svc_name":"Example Name","uid":"string"},"query":{"class":"string","hostname":"Example Name","opcode":"string","opcode_id":123,"packet_uid":123,"type":"string"},"query_time_dt":"string","raw_data":"string","rcode":"string","response_time_dt":"string","severity":"string","src_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"tls":{"alert":123,"certificate":{"created_time_dt":"string","expiration_time_dt":"string","fingerprint":{},"issuer_dn":"string","serial_number":"string","subject_dn":"string","version":"string"},"certificate_chain":["string"],"cipher":"string","client_ciphers":["string"],"extension_list":[{"data":{},"type":"string"}],"handshake_dur":123,"ja3_fingerprint":{"algorithm":"string","value":"string"},"ja3_string":"string","ja3s_fingerprint":{"algorithm":"string","value":"string"},"ja3s_string":"string","key_length":123,"sans":[{"name":"Example Name","type":"string"}],"server_ciphers":["string"],"sni":"string","version":"string"},"traffic":{"bytes":123,"bytes_in":123,"bytes_out":123,"packets":123,"packets_in":123,"packets_out":123},"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
answers	array	The Domain Name System (DNS) answers.
answers.class	string	The class of DNS data contained in this resource record. See https://www.rfc-editor.org/rfc/rfc1035.txtRFC1035 . For example: IN .
answers.flags	array	The list of DNS answer header flags.
answers.packet_uid	integer	The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.
answers.rdata	string	The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record.
answers.ttl	integer	The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached.
answers.type	string	The type of data contained in this resource record. See https://www.rfc-editor.org/rfc/rfc1035.txtRFC1035 . For example: CNAME .
app_name	string	The name of the application that is associated with the event or object.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: DNS Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.

Output Example

{"activity_name":"string","answers":[],"app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"...

Email Delivery Activity

Create an Email Delivery Activity Event in SOS Network Activity Events Pt1 using the specified activity data.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
email_delivery_activity	object	Required	Parameter for Email Delivery Activity
email_delivery_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
email_delivery_activity.attacks	array	Optional	An array of attacks associated with an event.
email_delivery_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_delivery_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_delivery_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_delivery_activity.attacks.technique	object	Required	The attack technique.
email_delivery_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
email_delivery_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
email_delivery_activity.attacks.version	string	Required	The ATT&CK Matrix version.
email_delivery_activity.attempt	string	Optional	attempt
email_delivery_activity.banner	string	Optional	banner
email_delivery_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
email_delivery_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
email_delivery_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
email_delivery_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
email_delivery_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
email_delivery_activity.cloud.project_uid	string	Optional	Cloud project identifier.
email_delivery_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
email_delivery_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
email_delivery_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
email_delivery_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
email_delivery_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
email_delivery_activity.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
email_delivery_activity.data	object	Optional	Additional data that is associated with the event.

Input Example

{"email_delivery_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"attempt":"string","banner":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"disposition":"string","duration":123,"email":{"cc":["string"],"contains":[{"enrichments":[],"name":"Example Name","type":"string","value":{}}],"content_type":"string","delivered_to":"string","direction":"string","from":"string","message_uid":"string","mime_parts":[{"content":{},"content_disposition":"string","content_text":"string","content_type":"string"}],"reply_to":"string","size":123,"smtp_from":"string","smtp_headers":[{"name":"Example Name","value":{}}],"smtp_hello":"string","smtp_to":["string"],"subject":"string","to":["string"],"x_originating_ip":["string"]},"email_auth":{"dkim":"string","dkim_domain":"string","dmarc":"string","dmarc_override":"string","dmarc_policy":"string","raw_header":"string","spf":"string"},"email_uid":"string","end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","receiver_hostname":"Example Name","receiver_ip":"string","sender_hostname":"Example Name","sender_ip":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
attempt	string	attempt
banner	string	banner
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: Email Delivery Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.

Output Example

{"activity_name":"string","attacks":[],"attempt":"string","banner":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"disposition":"string","duration":123,"email":{"cc":["string"],"contains":[{}],"content_type":"string","delivered_to":"string","dir...

Email File Activity

Create an Email File Activity Event in SOS Network Activity Events Pt1 using the specified details.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
email_file_activity	object	Required	Parameter for Email File Activity
email_file_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
email_file_activity.attacks	array	Optional	An array of attacks associated with an event.
email_file_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_file_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_file_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_file_activity.attacks.technique	object	Required	The attack technique.
email_file_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
email_file_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
email_file_activity.attacks.version	string	Required	The ATT&CK Matrix version.
email_file_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
email_file_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
email_file_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
email_file_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
email_file_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
email_file_activity.cloud.project_uid	string	Optional	Cloud project identifier.
email_file_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
email_file_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
email_file_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
email_file_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
email_file_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
email_file_activity.connection_uid	string	Optional	The network connection identifier.
email_file_activity.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
email_file_activity.data	object	Optional	Additional data that is associated with the event.
email_file_activity.disposition	string	Optional	The event disposition name, as defined by the disposition_id.

Input Example

{"email_file_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[{"algorithm":"string","value":"string"}],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"security_descriptor":"string","signature":{"company_name":"Example Name","created_time_dt":"string","developer_uid":"string","fingerprints":[],"issuer_name":"Example Name","serial_number":"string"},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: Email File Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
connection_uid	string	The network connection identifier.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.

Output Example

{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","att...

Email URL Activity

Create an Email URL Activity Event in SOS Network Activity Events Pt1 using the specified details.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
email_url_activity	object	Required	URL endpoint for the request
email_url_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
email_url_activity.attacks	array	Optional	An array of attacks associated with an event.
email_url_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_url_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_url_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
email_url_activity.attacks.technique	object	Required	The attack technique.
email_url_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
email_url_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
email_url_activity.attacks.version	string	Required	The ATT&CK Matrix version.
email_url_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
email_url_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
email_url_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
email_url_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
email_url_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
email_url_activity.cloud.project_uid	string	Optional	Cloud project identifier.
email_url_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
email_url_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
email_url_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
email_url_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
email_url_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
email_url_activity.connection_uid	string	Optional	The network connection identifier.
email_url_activity.count	integer	Optional	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
email_url_activity.data	object	Optional	Additional data that is associated with the event.
email_url_activity.disposition	string	Optional	The event disposition name, as defined by the disposition_id.

Input Example

{"email_url_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{},"url":{"categories":["string"],"hostname":"Example Name","path":"string","port":123,"query_string":"string","reputation":{"base_score":123,"provider":"string","score":"string"},"resource_type":"string","scheme":"string","text":"string"}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: Email URL Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
connection_uid	string	The network connection identifier.
count	integer	The number of times that events in the same logical group occurred during the event Start Time to End Time period.
data	object	Additional data that is associated with the event.

Output Example

FTP Activity

Create an FTP Activity Event in SOS Network Activity Events Pt1 using the provided activity details.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
ftp_activity	object	Required	Parameter for FTP Activity
ftp_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
ftp_activity.app_name	string	Optional	The name of the application that is associated with the event or object.
ftp_activity.attacks	array	Optional	An array of attacks associated with an event.
ftp_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
ftp_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
ftp_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
ftp_activity.attacks.technique	object	Required	The attack technique.
ftp_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
ftp_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
ftp_activity.attacks.version	string	Required	The ATT&CK Matrix version.
ftp_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
ftp_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
ftp_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
ftp_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
ftp_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
ftp_activity.cloud.project_uid	string	Optional	Cloud project identifier.
ftp_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
ftp_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
ftp_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
ftp_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
ftp_activity.codes	array	Optional	The list of return codes to the FTP command.
ftp_activity.command	string	Optional	The FTP command.
ftp_activity.command_responses	array	Optional	The list of responses to the FTP command.
ftp_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.

Input Example

{"ftp_activity":{"activity_name":"Example Name","app_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"codes":[],"command":"string","command_responses":["string"],"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"count":123,"data":{},"disposition":"string","dst_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"duration":123,"end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"name":"Example Name","observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"port":123,"proxy":{"hostname":"Example Name","ip":"string","port":123,"svc_name":"Example Name","uid":"string"},"raw_data":"string","severity":"string","src_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"tls":{"alert":123,"certificate":{"created_time_dt":"string","expiration_time_dt":"string","fingerprint":{},"issuer_dn":"string","serial_number":"string","subject_dn":"string","version":"string"},"certificate_chain":["string"],"cipher":"string","client_ciphers":["string"],"extension_list":[{"data":{},"type":"string"}],"handshake_dur":123,"ja3_fingerprint":{"algorithm":"string","value":"string"},"ja3_string":"string","ja3s_fingerprint":{"algorithm":"string","value":"string"},"ja3s_string":"string","key_length":123,"sans":[{"name":"Example Name","type":"string"}],"server_ciphers":["string"],"sni":"string","version":"string"},"traffic":{"bytes":123,"bytes_in":123,"bytes_out":123,"packets":123,"packets_in":123,"packets_out":123},"type":"string","unmapped":{}}}

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
app_name	string	The name of the application that is associated with the event or object.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: FTP Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
codes	array	The list of return codes to the FTP command.
command	string	The FTP command.
command_responses	array	The list of responses to the FTP command.

Output Example

{"activity_name":"string","app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"codes":[],"command":"string","command_responses":[],"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protoc...

HTTP Activity

Create an HTTP Activity Event in SOS Network Activity Events Pt1 using the provided activity data.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
http_activity	object	Required	Parameter for HTTP Activity
http_activity.activity_name	string	Required	The event activity name, as defined by the activity_id.
http_activity.app_name	string	Optional	The name of the application that is associated with the event or object.
http_activity.attacks	array	Optional	An array of attacks associated with an event.
http_activity.attacks.tactics	array	Required	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
http_activity.attacks.tactics.name	string	Optional	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
http_activity.attacks.tactics.uid	string	Required	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
http_activity.attacks.technique	object	Required	The attack technique.
http_activity.attacks.technique.name	string	Optional	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
http_activity.attacks.technique.uid	string	Required	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
http_activity.attacks.version	string	Required	The ATT&CK Matrix version.
http_activity.cloud	object	Optional	Describes details about the Cloud enviroment where the event was originally created or logged.
http_activity.cloud.account_name	string	Optional	The name of the account (e.g. AWS Account Name).
http_activity.cloud.account_type	string	Optional	The user account type, as defined by the event source.
http_activity.cloud.account_uid	string	Optional	The unique identifier of the account (e.g. AWS Account ID).
http_activity.cloud.org_uid	string	Optional	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
http_activity.cloud.project_uid	string	Optional	Cloud project identifier.
http_activity.cloud.provider	string	Required	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
http_activity.cloud.region	string	Optional	The name of the cloud region, as defined by the cloud provider.
http_activity.cloud.resource_uid	string	Optional	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
http_activity.cloud.zone	string	Optional	The availability zone in the cloud region, as defined by the cloud provider.
http_activity.confidence	integer	Optional	The confidence of the reported event severity as a percentage: 0%-100%.
http_activity.connection_info	object	Optional	The network connection information.
http_activity.connection_info.boundary	string	Optional	The boundary of the connection, as defined by the event source. For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.
http_activity.connection_info.direction	string	Optional	The direction of the initiated connection.

Input Example

Output

Parameter	Type	Description
activity_name	string	The event activity name, as defined by the activity_id.
app_name	string	The name of the application that is associated with the event or object.
attacks	array	An array of attacks associated with an event.
attacks.tactics	array	The a list of tactic ID's/names that are associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.name	string	The tactic name that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.tactics.uid	string	The tactic ID that is associated with the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM .
attacks.technique	object	The attack technique.
attacks.technique.name	string	The name of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: Drive-by Compromise .
attacks.technique.uid	string	The unique identifier of the attack technique, as defined by https://attack.mitre.org/wiki/ATT&CK_MatrixATT&CK Matrix TM . For example: T1189 .
attacks.version	string	The ATT&CK Matrix version.
category_name	string	The event category name, as defined by category_uid value: Network Activity .
class_name	string	The event class name, as defined by class_uid value: HTTP Activity .
cloud	object	Describes details about the Cloud enviroment where the event was originally created or logged.
cloud.account_name	string	The name of the account (e.g. AWS Account Name).
cloud.account_type	string	The user account type, as defined by the event source.
cloud.account_uid	string	The unique identifier of the account (e.g. AWS Account ID).
cloud.org_uid	string	The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.
cloud.project_uid	string	Cloud project identifier.
cloud.provider	string	The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc.
cloud.region	string	The name of the cloud region, as defined by the cloud provider.
cloud.resource_uid	string	The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id.
cloud.zone	string	The availability zone in the cloud region, as defined by the cloud provider.
confidence	integer	The confidence of the reported event severity as a percentage: 0%-100%.
connection_info	object	The network connection information.
connection_info.boundary	string	The boundary of the connection, as defined by the event source. For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

Output Example

{"activity_name":"string","app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"cou...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT