--- title: SOS Network Activity Events Pt1 slug: connectors/sos-network-activity-events-pt1 docTags: createdAt: 2026-06-09T16:30:03.008Z --- The SOS Network Activity Events Pt1 connector automates the creation of detailed network activity events, streamlining the process of monitoring and responding to network-related security incidents. SOS Network Activity Events Pt1 is a comprehensive solution for monitoring and responding to network events. This connector enables seamless integration with Swimlane Turbine, allowing users to automate the detection and handling of DHCP, DNS, email, FTP, and HTTP activities. By leveraging this connector, security teams can efficiently track network behavior, identify anomalies, and initiate rapid response actions, enhancing the overall security posture and reducing manual intervention. ## Capabilities - Create DHCP Activity events - Create DNS Activity events - Create Email Delivery Activity events - Create Email File Activity events - Create Email URL Activity events - Create FTP Activity events - Create HTTP Activity events # Actions ## DHCP Activity Create a DHCP Activity Event in SOS Network Activity Events Pt1 using the provided activity data. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dhcp_activity` | object | Required | Parameter for DHCP Activity | | `dhcp_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `dhcp_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `dhcp_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `dhcp_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `dhcp_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `dhcp_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `dhcp_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `dhcp_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `dhcp_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `dhcp_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `dhcp_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `dhcp_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `dhcp_activity.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `dhcp_activity.data` | object | Optional | Additional data that is associated with the event. | | `dhcp_activity.duration` | integer | Optional | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `dhcp_activity.end_time_dt` | string | Optional | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `dhcp_activity.is_renewal` | boolean | Optional | The indication of whether this is a lease/session renewal event. | | `dhcp_activity.lease_dur` | integer | Optional | This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events. (activity\_id = 1) | | `dhcp_activity.message` | string | Optional | The description of the event, as defined by the event source. | | `dhcp_activity.metadata` | object | Required | The metadata associated with the event. | | `dhcp_activity.metadata.correlation_uid` | string | Optional | The unique identifier used to correlate events. | | `dhcp_activity.metadata.labels` | array | Optional | The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.For example:
:::Iframe{code=""} :::
\["network", "connection.ip\:destination", "device.ip\:source"]

| | `dhcp_activity.metadata.logged_time_dt` | string | Optional | The time when the logging system collected and logged the event.This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
| | `dhcp_activity.metadata.modified_time_dt` | string | Optional | The time when the event was last modified or enriched. | ### Input Example `{"dhcp_activity":{"activity_name":"Example Name","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","is_renewal":true,"lease_dur":123,"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"network_interface":{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","relay":{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"},"severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"transaction_uid":"string","unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
DHCP Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | Additional data that is associated with the event. | | `duration` | integer | The event duration or aggregate time, the amount of time the event covers from
:::Iframe{code=""} :::
start\_time to
:::Iframe{code=""} :::
end\_time in milliseconds.

| | `end_time_dt` | string | The end time of a time period, or the time of the most recent event included in the aggregate event. | | `is_renewal` | boolean | The indication of whether this is a lease/session renewal event. | | `lease_dur` | integer | This represents the length of the DHCP lease in seconds. This is present in DHCP Ack events. (activity\_id = 1) | | `message` | string | The description of the event, as defined by the event source. | | `metadata` | object | The metadata associated with the event. | | `metadata.correlation_uid` | string | The unique identifier used to correlate events. | | `metadata.labels` | array | The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.For example:
:::Iframe{code=""} :::
\["network", "connection.ip\:destination", "device.ip\:source"]

| | `metadata.logged_time_dt` | string | The time when the logging system collected and logged the event.This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
| ### Output Example `{"activity_name":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"duration":123,"end_time_dt":"string","is_renewal":true,"lease_dur":123,"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modi...` ## DNS Activity Create a DNS Activity Event in SOS Network Activity Events Pt1 using the provided DNS activity data. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `dns_activity` | object | Required | Parameter for DNS Activity | | `dns_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `dns_activity.answers` | array | Optional | The Domain Name System (DNS) answers. | | `dns_activity.answers.class` | string | Required | The class of DNS data contained in this resource record. See [https://www.rfc-editor.org/rfc/rfc1035.txt](https://www.rfc-editor.org/rfc/rfc1035.txt)RFC1035. For example:
:::Iframe{code=""} :::
IN.

| | `dns_activity.answers.flags` | array | Optional | The list of DNS answer header flags. | | `dns_activity.answers.packet_uid` | integer | Optional | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | | `dns_activity.answers.rdata` | string | Required | The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record. | | `dns_activity.answers.ttl` | integer | Optional | The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached. | | `dns_activity.answers.type` | string | Required | The type of data contained in this resource record. See [https://www.rfc-editor.org/rfc/rfc1035.txt](https://www.rfc-editor.org/rfc/rfc1035.txt)RFC1035. For example:
:::Iframe{code=""} :::
CNAME.

| | `dns_activity.app_name` | string | Optional | The name of the application that is associated with the event or object. | | `dns_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `dns_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `dns_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `dns_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `dns_activity.attacks.technique` | object | Required | The attack technique. | | `dns_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `dns_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `dns_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `dns_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `dns_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `dns_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `dns_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `dns_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `dns_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `dns_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | ### Input Example `{"dns_activity":{"activity_name":"Example Name","answers":[{"class":"string","flags":["string"],"packet_uid":123,"rdata":"string","ttl":123,"type":"string"}],"app_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"count":123,"data":{},"disposition":"string","dst_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"duration":123,"end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"proxy":{"hostname":"Example Name","ip":"string","port":123,"svc_name":"Example Name","uid":"string"},"query":{"class":"string","hostname":"Example Name","opcode":"string","opcode_id":123,"packet_uid":123,"type":"string"},"query_time_dt":"string","raw_data":"string","rcode":"string","response_time_dt":"string","severity":"string","src_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"tls":{"alert":123,"certificate":{"created_time_dt":"string","expiration_time_dt":"string","fingerprint":{},"issuer_dn":"string","serial_number":"string","subject_dn":"string","version":"string"},"certificate_chain":["string"],"cipher":"string","client_ciphers":["string"],"extension_list":[{"data":{},"type":"string"}],"handshake_dur":123,"ja3_fingerprint":{"algorithm":"string","value":"string"},"ja3_string":"string","ja3s_fingerprint":{"algorithm":"string","value":"string"},"ja3s_string":"string","key_length":123,"sans":[{"name":"Example Name","type":"string"}],"server_ciphers":["string"],"sni":"string","version":"string"},"traffic":{"bytes":123,"bytes_in":123,"bytes_out":123,"packets":123,"packets_in":123,"packets_out":123},"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `answers` | array | The Domain Name System (DNS) answers. | | `answers.class` | string | The class of DNS data contained in this resource record. See [https://www.rfc-editor.org/rfc/rfc1035.txt](https://www.rfc-editor.org/rfc/rfc1035.txt)RFC1035. For example:
:::Iframe{code=""} :::
IN.

| | `answers.flags` | array | The list of DNS answer header flags. | | `answers.packet_uid` | integer | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | | `answers.rdata` | string | The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record. | | `answers.ttl` | integer | The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached. | | `answers.type` | string | The type of data contained in this resource record. See [https://www.rfc-editor.org/rfc/rfc1035.txt](https://www.rfc-editor.org/rfc/rfc1035.txt)RFC1035. For example:
:::Iframe{code=""} :::
CNAME.

| | `app_name` | string | The name of the application that is associated with the event or object. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
DNS Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | ### Output Example `{"activity_name":"string","answers":[],"app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"...` ## Email Delivery Activity Create an Email Delivery Activity Event in SOS Network Activity Events Pt1 using the specified activity data. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `email_delivery_activity` | object | Required | Parameter for Email Delivery Activity | | `email_delivery_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `email_delivery_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `email_delivery_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_delivery_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_delivery_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_delivery_activity.attacks.technique` | object | Required | The attack technique. | | `email_delivery_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `email_delivery_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `email_delivery_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `email_delivery_activity.attempt` | string | Optional | attempt | | `email_delivery_activity.banner` | string | Optional | banner | | `email_delivery_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `email_delivery_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `email_delivery_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `email_delivery_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `email_delivery_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `email_delivery_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `email_delivery_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `email_delivery_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `email_delivery_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `email_delivery_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `email_delivery_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `email_delivery_activity.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `email_delivery_activity.data` | object | Optional | Additional data that is associated with the event. | ### Input Example `{"email_delivery_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"attempt":"string","banner":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"disposition":"string","duration":123,"email":{"cc":["string"],"contains":[{"enrichments":[],"name":"Example Name","type":"string","value":{}}],"content_type":"string","delivered_to":"string","direction":"string","from":"string","message_uid":"string","mime_parts":[{"content":{},"content_disposition":"string","content_text":"string","content_type":"string"}],"reply_to":"string","size":123,"smtp_from":"string","smtp_headers":[{"name":"Example Name","value":{}}],"smtp_hello":"string","smtp_to":["string"],"subject":"string","to":["string"],"x_originating_ip":["string"]},"email_auth":{"dkim":"string","dkim_domain":"string","dmarc":"string","dmarc_override":"string","dmarc_policy":"string","raw_header":"string","spf":"string"},"email_uid":"string","end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","receiver_hostname":"Example Name","receiver_ip":"string","sender_hostname":"Example Name","sender_ip":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `attempt` | string | attempt | | `banner` | string | banner | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Email Delivery Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| ### Output Example `{"activity_name":"string","attacks":[],"attempt":"string","banner":"string","category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"count":123,"data":{},"disposition":"string","duration":123,"email":{"cc":["string"],"contains":[{}],"content_type":"string","delivered_to":"string","dir...` ## Email File Activity Create an Email File Activity Event in SOS Network Activity Events Pt1 using the specified details. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `email_file_activity` | object | Required | Parameter for Email File Activity | | `email_file_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `email_file_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `email_file_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_file_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_file_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_file_activity.attacks.technique` | object | Required | The attack technique. | | `email_file_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `email_file_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `email_file_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `email_file_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `email_file_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `email_file_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `email_file_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `email_file_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `email_file_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `email_file_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `email_file_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `email_file_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `email_file_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `email_file_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `email_file_activity.connection_uid` | string | Optional | The network connection identifier. | | `email_file_activity.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `email_file_activity.data` | object | Optional | Additional data that is associated with the event. | | `email_file_activity.disposition` | string | Optional | The event disposition name, as defined by the disposition\_id. | ### Input Example `{"email_file_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[{"algorithm":"string","value":"string"}],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"security_descriptor":"string","signature":{"company_name":"Example Name","created_time_dt":"string","developer_uid":"string","fingerprints":[],"issuer_name":"Example Name","serial_number":"string"},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Email File Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `connection_uid` | string | The network connection identifier. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | Additional data that is associated with the event. | ### Output Example `{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","att...` ## Email URL Activity Create an Email URL Activity Event in SOS Network Activity Events Pt1 using the specified details. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `email_url_activity` | object | Required | URL endpoint for the request | | `email_url_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `email_url_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `email_url_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_url_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_url_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `email_url_activity.attacks.technique` | object | Required | The attack technique. | | `email_url_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `email_url_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `email_url_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `email_url_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `email_url_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `email_url_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `email_url_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `email_url_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `email_url_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `email_url_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `email_url_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `email_url_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `email_url_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `email_url_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `email_url_activity.connection_uid` | string | Optional | The network connection identifier. | | `email_url_activity.count` | integer | Optional | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `email_url_activity.data` | object | Optional | Additional data that is associated with the event. | | `email_url_activity.disposition` | string | Optional | The event disposition name, as defined by the disposition\_id. | ### Input Example `{"email_url_activity":{"activity_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"raw_data":"string","severity":"string","start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"unmapped":{},"url":{"categories":["string"],"hostname":"Example Name","path":"string","port":123,"query_string":"string","reputation":{"base_score":123,"provider":"string","score":"string"},"resource_type":"string","scheme":"string","text":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
Email URL Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `connection_uid` | string | The network connection identifier. | | `count` | integer | The number of times that events in the same logical group occurred during the event ****Start Time to ****End Time period.

| | `data` | object | Additional data that is associated with the event. | ### Output Example `{"activity_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_uid":"string","count":123,"data":{},"disposition":"string","duration":123,"email_uid":"string","end_time_dt":"string","malware":[],"message":"string"}` ## FTP Activity Create an FTP Activity Event in SOS Network Activity Events Pt1 using the provided activity details. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ftp_activity` | object | Required | Parameter for FTP Activity | | `ftp_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `ftp_activity.app_name` | string | Optional | The name of the application that is associated with the event or object. | | `ftp_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `ftp_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `ftp_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `ftp_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `ftp_activity.attacks.technique` | object | Required | The attack technique. | | `ftp_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `ftp_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `ftp_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `ftp_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `ftp_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `ftp_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `ftp_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `ftp_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `ftp_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `ftp_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `ftp_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `ftp_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `ftp_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `ftp_activity.codes` | array | Optional | The list of return codes to the FTP command. | | `ftp_activity.command` | string | Optional | The FTP command. | | `ftp_activity.command_responses` | array | Optional | The list of responses to the FTP command. | | `ftp_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | ### Input Example `{"ftp_activity":{"activity_name":"Example Name","app_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"codes":[],"command":"string","command_responses":["string"],"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"count":123,"data":{},"disposition":"string","dst_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"duration":123,"end_time_dt":"string","malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"name":"Example Name","observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"port":123,"proxy":{"hostname":"Example Name","ip":"string","port":123,"svc_name":"Example Name","uid":"string"},"raw_data":"string","severity":"string","src_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"tls":{"alert":123,"certificate":{"created_time_dt":"string","expiration_time_dt":"string","fingerprint":{},"issuer_dn":"string","serial_number":"string","subject_dn":"string","version":"string"},"certificate_chain":["string"],"cipher":"string","client_ciphers":["string"],"extension_list":[{"data":{},"type":"string"}],"handshake_dur":123,"ja3_fingerprint":{"algorithm":"string","value":"string"},"ja3_string":"string","ja3s_fingerprint":{"algorithm":"string","value":"string"},"ja3s_string":"string","key_length":123,"sans":[{"name":"Example Name","type":"string"}],"server_ciphers":["string"],"sni":"string","version":"string"},"traffic":{"bytes":123,"bytes_in":123,"bytes_out":123,"packets":123,"packets_in":123,"packets_out":123},"type":"string","unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `app_name` | string | The name of the application that is associated with the event or object. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
FTP Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `codes` | array | The list of return codes to the FTP command. | | `command` | string | The FTP command. | | `command_responses` | array | The list of responses to the FTP command. | ### Output Example `{"activity_name":"string","app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"codes":[],"command":"string","command_responses":[],"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protoc...` ## HTTP Activity Create an HTTP Activity Event in SOS Network Activity Events Pt1 using the provided activity data. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `http_activity` | object | Required | Parameter for HTTP Activity | | `http_activity.activity_name` | string | Required | The event activity name, as defined by the activity\_id. | | `http_activity.app_name` | string | Optional | The name of the application that is associated with the event or object. | | `http_activity.attacks` | array | Optional | An array of attacks associated with an event. | | `http_activity.attacks.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `http_activity.attacks.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `http_activity.attacks.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `http_activity.attacks.technique` | object | Required | The attack technique. | | `http_activity.attacks.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `http_activity.attacks.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `http_activity.attacks.version` | string | Required | The ATT\&CK Matrix version. | | `http_activity.cloud` | object | Optional | Describes details about the Cloud enviroment where the event was originally created or logged. | | `http_activity.cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `http_activity.cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `http_activity.cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `http_activity.cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `http_activity.cloud.project_uid` | string | Optional | Cloud project identifier. | | `http_activity.cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `http_activity.cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `http_activity.cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `http_activity.cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | | `http_activity.confidence` | integer | Optional | The confidence of the reported event severity as a percentage: 0%-100%. | | `http_activity.connection_info` | object | Optional | The network connection information. | | `http_activity.connection_info.boundary` | string | Optional | The boundary of the connection, as defined by the event source. For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

| | `http_activity.connection_info.direction` | string | Optional | The direction of the initiated connection. | ### Input Example `{"http_activity":{"activity_name":"Example Name","app_name":"Example Name","attacks":[{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}],"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"count":123,"data":{},"disposition":"string","dst_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"duration":123,"end_time_dt":"string","http_request":{"args":"string","http_headers":[{"name":"Example Name","value":{}}],"http_method":"string","prefix":"string","referrer":"string","uid":"string","url":{"categories":["string"],"hostname":"Example Name","path":"string","port":123,"query_string":"string","reputation":{},"resource_type":"string","scheme":"string","text":"string"},"user_agent":"string","version":"string","x_forwarded_for":["string"]},"http_response":{"code":123,"content_type":"string","latency":123,"length":123,"message":"string","status":"active"},"http_status":123,"malware":[{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}],"message":"string","metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"},"observables":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"proxy":{"hostname":"Example Name","ip":"string","port":123,"svc_name":"Example Name","uid":"string"},"raw_data":"string","severity":"string","src_endpoint":{"domain":"string","hostname":"Example Name","instance_uid":"string","interface_uid":"string","intermediate_ips":["string"],"ip":"string","location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","port":123,"reputation":{"base_score":123,"provider":"string","score":"string"},"subnet_uid":"string","svc_name":"Example Name","uid":"string","vlan_uid":"string","vpc_uid":"string"},"start_time_dt":"string","status":"active","status_detail":"active","time_dt":"string","timezone_offset":123,"tls":{"alert":123,"certificate":{"created_time_dt":"string","expiration_time_dt":"string","fingerprint":{},"issuer_dn":"string","serial_number":"string","subject_dn":"string","version":"string"},"certificate_chain":["string"],"cipher":"string","client_ciphers":["string"],"extension_list":[{"data":{},"type":"string"}],"handshake_dur":123,"ja3_fingerprint":{"algorithm":"string","value":"string"},"ja3_string":"string","ja3s_fingerprint":{"algorithm":"string","value":"string"},"ja3s_string":"string","key_length":123,"sans":[{"name":"Example Name","type":"string"}],"server_ciphers":["string"],"sni":"string","version":"string"},"traffic":{"bytes":123,"bytes_in":123,"bytes_out":123,"packets":123,"packets_in":123,"packets_out":123},"unmapped":{}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `activity_name` | string | The event activity name, as defined by the activity\_id. | | `app_name` | string | The name of the application that is associated with the event or object. | | `attacks` | array | An array of attacks associated with an event. | | `attacks.tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM.

| | `attacks.technique` | object | The attack technique. | | `attacks.technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
Drive-by Compromise.


| | `attacks.technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK Matrix
:::Iframe{code=""} :::
TM. For example:
:::Iframe{code=""} :::
T1189.


| | `attacks.version` | string | The ATT\&CK Matrix version. | | `category_name` | string | The event category name, as defined by category\_uid value:
:::Iframe{code=""} :::
Network Activity.
| | `class_name` | string | The event class name, as defined by class\_uid value:
:::Iframe{code=""} :::
HTTP Activity.
| | `cloud` | object | Describes details about the Cloud enviroment where the event was originally created or logged. | | `cloud.account_name` | string | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | The user account type, as defined by the event source. | | `cloud.account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Cloud project identifier. | | `cloud.provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | | `confidence` | integer | The confidence of the reported event severity as a percentage: 0%-100%. | | `connection_info` | object | The network connection information. | | `connection_info.boundary` | string | The boundary of the connection, as defined by the event source. For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External.

| ### Output Example `{"activity_name":"string","app_name":"string","attacks":[],"category_name":"string","class_name":"string","cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"},"confidence":123,"connection_info":{"boundary":"string","direction":"string","protocol_name":"Example Name","protocol_num":123,"protocol_ver":"string","tcp_flags":123,"uid":"string"},"cou...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |