--- title: SOS Objects Pt1 slug: connectors/sos-objects-pt1 docTags: createdAt: 2026-06-09T16:30:09.202Z --- The SOS Objects Pt1 connector enables seamless interaction with a multitude of security and operational tasks, providing a versatile toolkit for data retrieval and management. SOS Objects Pt1 is a comprehensive security automation platform that captures elusive telemetry and broadens the scope of actions beyond the conventional XDR ecosystem. This connector enables seamless integration with third-party tools, allowing users to install and utilize capabilities from various services within Swimlane playbooks. By leveraging this connector, users can effortlessly configure inputs and outputs for APIs, enhancing their security operations with code-free automation. ## Prerequisites None # Actions ## Actor Retrieve details for a specified actor from SOS Objects Pt1, requiring the 'actor' input parameter. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `actor` | object | Required | Parameter for Actor | | `actor.process` | object | Optional | The process that initiated the activity. | | `actor.process.cmd_line` | string | Optional | The full command line used to launch an application, service, process, or job. For example: ssh user\@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used



| | `actor.process.created_time_dt` | string | Optional | The time when the process was created/started. | | `actor.process.file` | object | Optional | The process file object. | | `actor.process.file.accessed_time_dt` | string | Optional | The time when the file was last accessed. | | `actor.process.file.accessor` | string | Optional | The name of the user who last accessed the object. | | `actor.process.file.attributes` | integer | Optional | The bitmask value that represents the file attributes. | | `actor.process.file.company_name` | string | Optional | The name of the company that published the file. For example: Microsoft Corporation.

| | `actor.process.file.confidentiality` | string | Optional | The file content confidentiality, as defined by the event source. | | `actor.process.file.created_time_dt` | string | Optional | The time when the file was created. | | `actor.process.file.creator` | string | Optional | The user that created the file. | | `actor.process.file.desc` | string | Optional | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `actor.process.file.fingerprints` | array | Optional | An array of digital fingerprint objects. | | `actor.process.file.fingerprints.algorithm` | string | Optional | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `actor.process.file.fingerprints.value` | string | Required | The digital fingerprint value. | | `actor.process.file.is_system` | boolean | Optional | The indication of whether the object is part of the operating system. | | `actor.process.file.mime_type` | string | Optional | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `actor.process.file.modified_time_dt` | string | Optional | The time when the file was last modified. | | `actor.process.file.modifier` | string | Optional | The user that last modified the file. | | `actor.process.file.name` | string | Required | The name of the file. For example: svchost.exe

| | `actor.process.file.owner` | string | Optional | The user that owns the file/object. | | `actor.process.file.parent_folder` | string | Optional | The parent folder in which the file resides. For example: c:\windows\system32

| | `actor.process.file.path` | string | Optional | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `actor.process.file.product` | object | Optional | The product that created or installed the file. | ### Input Example `{"actor":{"process":{"cmd_line":"string","created_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{},"security_descriptor":"string","signature":{},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{"cmd_line":"string","created_time_dt":"string","file":{},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{},"xattributes":{}},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"xattributes":{}},"user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `process` | object | The process that initiated the activity. | | `process.cmd_line` | string | The full command line used to launch an application, service, process, or job. For example: ssh user\@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used



| | `process.created_time_dt` | string | The time when the process was created/started. | | `process.file` | object | The process file object. | | `process.file.accessed_time_dt` | string | The time when the file was last accessed. | | `process.file.accessor` | string | The name of the user who last accessed the object. | | `process.file.attributes` | integer | The bitmask value that represents the file attributes. | | `process.file.company_name` | string | The name of the company that published the file. For example: Microsoft Corporation.

| | `process.file.confidentiality` | string | The file content confidentiality, as defined by the event source. | | `process.file.created_time_dt` | string | The time when the file was created. | | `process.file.creator` | string | The user that created the file. | | `process.file.desc` | string | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `process.file.fingerprints` | array | An array of digital fingerprint objects. | | `process.file.fingerprints.algorithm` | string | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `process.file.fingerprints.value` | string | The digital fingerprint value. | | `process.file.is_system` | boolean | The indication of whether the object is part of the operating system. | | `process.file.mime_type` | string | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `process.file.modified_time_dt` | string | The time when the file was last modified. | | `process.file.modifier` | string | The user that last modified the file. | | `process.file.name` | string | The name of the file. For example: svchost.exe

| | `process.file.owner` | string | The user that owns the file/object. | | `process.file.parent_folder` | string | The parent folder in which the file resides. For example: c:\windows\system32

| | `process.file.path` | string | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `process.file.product` | object | The product that created or installed the file. | | `process.file.product.feature` | object | The feature that reported the event. | ### Output Example `{"process":{"cmd_line":"string","created_time_dt":"string","file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string"},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example ...` ## Attack Executes an attack action within SOS Objects Pt1 using the specified 'attack' parameter. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `attack` | object | Required | Parameter for Attack | | `attack.tactics` | array | Required | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `attack.tactics.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `attack.tactics.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `attack.technique` | object | Required | The attack technique. | | `attack.technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: Drive-by Compromise.




| | `attack.technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: T1189.




| | `attack.version` | string | Required | The ATT\&CK Matrix version. | ### Input Example `{"attack":{"tactics":[{"name":"Example Name","uid":"string"}],"technique":{"name":"Example Name","uid":"string"},"version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `tactics` | array | The a list of tactic ID's/names that are associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `tactics.name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `tactics.uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `technique` | object | The attack technique. | | `technique.name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: Drive-by Compromise.




| | `technique.uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: T1189.




| | `version` | string | The ATT\&CK Matrix version. | ### Output Example `{"tactics":[],"technique":{"name":"Example Name","uid":"string"},"version":"string"}` ## Cloud Interact with cloud services to perform operations specified by the 'cloud' input parameter in SOS Objects Pt1. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------- | | `cloud` | object | Required | Parameter for Cloud | | `cloud.account_name` | string | Optional | The name of the account (e.g. AWS Account Name). | | `cloud.account_type` | string | Optional | The user account type, as defined by the event source. | | `cloud.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `cloud.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `cloud.project_uid` | string | Optional | Cloud project identifier. | | `cloud.provider` | string | Required | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `cloud.region` | string | Optional | The name of the cloud region, as defined by the cloud provider. | | `cloud.resource_uid` | string | Optional | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `cloud.zone` | string | Optional | The availability zone in the cloud region, as defined by the cloud provider. | ### Input Example `{"cloud":{"account_name":"Example Name","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | ----------------------------------------------------------------------------------------------------------------- | | `account_name` | string | The name of the account (e.g. AWS Account Name). | | `account_type` | string | The user account type, as defined by the event source. | | `account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `project_uid` | string | Cloud project identifier. | | `provider` | string | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | | `region` | string | The name of the cloud region, as defined by the cloud provider. | | `resource_uid` | string | The unique identifier of a cloud resource. For example, S3 Bucket name, EC2 Instance Id. | | `zone` | string | The availability zone in the cloud region, as defined by the cloud provider. | ### Output Example `{"account_name":"string","account_type":"string","account_uid":"string","org_uid":"string","project_uid":"string","provider":"string","region":"string","resource_uid":"string","zone":"string"}` ## Compliance Details Initiates a compliance check within SOS Objects Pt1 using the provided 'compliance' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------- | | `compliance` | object | Required | Parameter for Compliance Details | | `compliance.requirements` | array | Optional | A list of applicable compliance requirements for which this finding is related to. | | `compliance.status` | string | Optional | The event status, as reported by the event source. | | `compliance.status_detail` | string | Optional | The status details contains additional information about the event outcome. | ### Input Example `{"compliance":{"requirements":["string"],"status":"active","status_detail":"active"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | ---------------------------------------------------------------------------------- | | `requirements` | array | A list of applicable compliance requirements for which this finding is related to. | | `status` | string | The event status, as reported by the event source. | | `status_detail` | string | The status details contains additional information about the event outcome. | ### Output Example `{"requirements":[],"status":"string","status_detail":"string"}` ## CVE Retrieve details for a specified Common Vulnerabilities and Exposures (CVE) identifier from SOS Objects Pt1. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cve` | object | Required | Parameter for CVE | | `cve.created_time_dt` | string | Optional | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `cve.cvss` | object | Optional | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `cve.cvss.base_score` | number | Required | The CVSS base score. For example: 9.1.

| | `cve.cvss.depth` | string | Optional | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `cve.cvss.metrics` | array | Optional | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `cve.cvss.metrics.name` | string | Required | The name of the metric. | | `cve.cvss.metrics.value` | object | Required | The value of the metric. | | `cve.cvss.overall_score` | number | Optional | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `cve.cvss.severity` | string | Optional | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `cve.cvss.vector_string` | string | Optional | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `cve.cvss.version` | string | Required | The CVSS version. For example: 3.1.

| | `cve.cwe_uid` | string | Optional | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `cve.cwe_url` | string | Optional | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `cve.modified_time_dt` | string | Optional | The Record Modified Date identifies when the CVE record was last updated. | | `cve.product` | object | Optional | The product where the vulnerability was discovered. | | `cve.product.feature` | object | Optional | The feature that reported the event. | | `cve.product.feature.name` | string | Optional | The name of the product feature. | | `cve.product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `cve.product.feature.version` | string | Optional | The version of the product feature. | | `cve.product.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `cve.product.name` | string | Required | The name of the product. | | `cve.product.path` | string | Optional | The installation path of the product. | | `cve.product.uid` | string | Optional | The unique identifier of the product. | | `cve.product.vendor_name` | string | Required | The name of the vendor of the product. | ### Input Example `{"cve":{"created_time_dt":"string","cvss":{"base_score":123,"depth":"string","metrics":[{"name":"Example Name","value":{}}],"overall_score":123,"severity":"string","vector_string":"string","version":"string"},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"type":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `created_time_dt` | string | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `cvss` | object | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `cvss.base_score` | number | The CVSS base score. For example: 9.1.

| | `cvss.depth` | string | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `cvss.metrics` | array | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `cvss.metrics.name` | string | The name of the metric. | | `cvss.metrics.value` | object | The value of the metric. | | `cvss.overall_score` | number | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `cvss.severity` | string | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `cvss.vector_string` | string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `cvss.version` | string | The CVSS version. For example: 3.1.

| | `cwe_uid` | string | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `cwe_url` | string | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `modified_time_dt` | string | The Record Modified Date identifies when the CVE record was last updated. | | `product` | object | The product where the vulnerability was discovered. | | `product.feature` | object | The feature that reported the event. | | `product.feature.name` | string | The name of the product feature. | | `product.feature.uid` | string | The unique identifier of the product feature. | | `product.feature.version` | string | The version of the product feature. | | `product.lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `product.name` | string | The name of the product. | | `product.path` | string | The installation path of the product. | | `product.uid` | string | The unique identifier of the product. | | `product.vendor_name` | string | The name of the vendor of the product. | | `product.version` | string | The version of the product, as defined by the event source. For example: 2013.1.3-beta.

| ### Output Example `{"created_time_dt":"string","cvss":{"base_score":123,"depth":"string","metrics":[{}],"overall_score":123,"severity":"string","vector_string":"string","version":"string"},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"type":"string","uid":"string"}` ## CVSS Score Retrieve the Common Vulnerability Scoring System (CVSS) score for a specified vulnerability. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cvss` | object | Required | Parameter for CVSS Score | | `cvss.base_score` | number | Required | The CVSS base score. For example: 9.1.

| | `cvss.depth` | string | Optional | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `cvss.metrics` | array | Optional | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `cvss.metrics.name` | string | Required | The name of the metric. | | `cvss.metrics.value` | object | Required | The value of the metric. | | `cvss.overall_score` | number | Optional | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `cvss.severity` | string | Optional | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `cvss.vector_string` | string | Optional | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `cvss.version` | string | Required | The CVSS version. For example: 3.1.

| ### Input Example `{"cvss":{"base_score":123,"depth":"string","metrics":[{"name":"Example Name","value":{}}],"overall_score":123,"severity":"string","vector_string":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `base_score` | number | The CVSS base score. For example: 9.1.

| | `depth` | string | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `metrics` | array | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `metrics.name` | string | The name of the metric. | | `metrics.value` | object | The value of the metric. | | `overall_score` | number | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `severity` | string | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `vector_string` | string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `version` | string | The CVSS version. For example: 3.1.

| ### Output Example `{"base_score":123,"depth":"string","metrics":[],"overall_score":123,"severity":"string","vector_string":"string","version":"string"}` ## Device Retrieve or interact with a specific device using its unique identifier within the SOS Objects Pt1 ecosystem. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `device` | object | Required | Parameter for Device | | `device.autoscale_uid` | string | Optional | The unique identifier of the cloud autoscale configuration. | | `device.desc` | string | Optional | The description of the device, ordinarily as reported by the operating system. | | `device.domain` | string | Optional | The network domain where the device resides. For example: work.example.com.

| | `device.groups` | array | Optional | The group names to which the device belongs. For example: \["Windows Laptops", "Engineering"].

| | `device.groups.desc` | string | Optional | The group description. | | `device.groups.name` | string | Required | The group name. | | `device.groups.privileges` | array | Optional | The group privileges. | | `device.groups.type` | string | Optional | The type of the group or account. | | `device.groups.uid` | string | Optional | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | | `device.hostname` | string | Optional | The device hostname. | | `device.hw_info` | object | Optional | The device hardware information. | | `device.hw_info.bios_date` | string | Optional | The BIOS date. For example: 03/31/16.

| | `device.hw_info.bios_manufacturer` | string | Optional | The BIOS manufacturer. For example: LENOVO.

| | `device.hw_info.bios_ver` | string | Optional | The BIOS version. For example: LENOVO G5ETA2WW (2.62).

| | `device.hw_info.chassis` | string | Optional | The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows [https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure)Windows Chassis Types
| | `device.hw_info.cpu_bits` | integer | Optional | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `device.hw_info.cpu_cores` | integer | Optional | The number of processor cores in all installed processors. For Example: 42.

| | `device.hw_info.cpu_count` | integer | Optional | The number of physical processors on a system. For example: 1.

| | `device.hw_info.cpu_speed` | integer | Optional | The speed of the processor in Mhz. For Example: 4200.

| | `device.hw_info.cpu_type` | string | Optional | The processor type. For example: x86 Family 6 Model 37 Stepping 5.

| | `device.hw_info.desktop_display` | object | Optional | The desktop display affiliated with the event | | `device.hw_info.desktop_display.color_depth` | integer | Optional | The numeric color depth. | | `device.hw_info.desktop_display.physical_height` | integer | Optional | The numeric physical height of display. | | `device.hw_info.desktop_display.physical_orientation` | integer | Optional | The numeric physical orientation of display. | ### Input Example `{"device":{"autoscale_uid":"string","desc":"string","domain":"string","groups":[{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}],"hostname":"Example Name","hw_info":{"bios_date":"string","bios_manufacturer":"string","bios_ver":"string","chassis":"string","cpu_bits":123,"cpu_cores":123,"cpu_count":123,"cpu_speed":123,"cpu_type":"string","desktop_display":{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123},"keyboard_info":{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":123,"keyboard_type":"string"},"ram_size":123,"serial_number":"string"},"hypervisor":"string","image":{"labels":["string"],"name":"Example Name","path":"string","tag":"string","uid":"string"},"imei":"string","instance_uid":"string","interface_uid":"string","ip":"string","is_compliant":true,"is_managed":true,"is_personal":true,"is_trusted":true,"location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"},"mac":"string","name":"Example Name","network_interfaces":[{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"}],"org_unit":"string","os":{"build":"string","country":"string","cpu_bits":123,"edition":"string","lang":"string","name":"Example Name","sp_name":"Example Name","sp_ver":123,"type":"string","version":"string"},"region":"string","reputation":{"base_score":123,"provider":"string","score":"string"},"risk_level":"string","risk_score":123,"subnet":"string","subnet_uid":"string","type":"string","uid":"string","vlan_uid":"string","vpc_uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `autoscale_uid` | string | The unique identifier of the cloud autoscale configuration. | | `desc` | string | The description of the device, ordinarily as reported by the operating system. | | `domain` | string | The network domain where the device resides. For example: work.example.com.

| | `groups` | array | The group names to which the device belongs. For example: \["Windows Laptops", "Engineering"].

| | `groups.desc` | string | The group description. | | `groups.name` | string | The group name. | | `groups.privileges` | array | The group privileges. | | `groups.type` | string | The type of the group or account. | | `groups.uid` | string | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | | `hostname` | string | The device hostname. | | `hw_info` | object | The device hardware information. | | `hw_info.bios_date` | string | The BIOS date. For example: 03/31/16.

| | `hw_info.bios_manufacturer` | string | The BIOS manufacturer. For example: LENOVO.

| | `hw_info.bios_ver` | string | The BIOS version. For example: LENOVO G5ETA2WW (2.62).

| | `hw_info.chassis` | string | The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows [https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure)Windows Chassis Types
| | `hw_info.cpu_bits` | integer | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `hw_info.cpu_cores` | integer | The number of processor cores in all installed processors. For Example: 42.

| | `hw_info.cpu_count` | integer | The number of physical processors on a system. For example: 1.

| | `hw_info.cpu_speed` | integer | The speed of the processor in Mhz. For Example: 4200.

| | `hw_info.cpu_type` | string | The processor type. For example: x86 Family 6 Model 37 Stepping 5.

| | `hw_info.desktop_display` | object | The desktop display affiliated with the event | | `hw_info.desktop_display.color_depth` | integer | The numeric color depth. | | `hw_info.desktop_display.physical_height` | integer | The numeric physical height of display. | | `hw_info.desktop_display.physical_orientation` | integer | The numeric physical orientation of display. | | `hw_info.desktop_display.physical_width` | integer | The numeric physical width of display. | ### Output Example `{"autoscale_uid":"string","desc":"string","domain":"string","groups":[],"hostname":"string","hw_info":{"bios_date":"string","bios_manufacturer":"string","bios_ver":"string","chassis":"string","cpu_bits":123,"cpu_cores":123,"cpu_count":123,"cpu_speed":123,"cpu_type":"string","desktop_display":{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123},"keyboard_info":{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":...` ## Device Hardware Info Retrieve detailed hardware information for a specified device using the SOS Objects Pt1 connector. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `device_hw_info` | object | Required | Parameter for Device Hardware Info | | `device_hw_info.bios_date` | string | Optional | The BIOS date. For example: 03/31/16.

| | `device_hw_info.bios_manufacturer` | string | Optional | The BIOS manufacturer. For example: LENOVO.

| | `device_hw_info.bios_ver` | string | Optional | The BIOS version. For example: LENOVO G5ETA2WW (2.62).

| | `device_hw_info.chassis` | string | Optional | The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows [https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure)Windows Chassis Types
| | `device_hw_info.cpu_bits` | integer | Optional | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `device_hw_info.cpu_cores` | integer | Optional | The number of processor cores in all installed processors. For Example: 42.

| | `device_hw_info.cpu_count` | integer | Optional | The number of physical processors on a system. For example: 1.

| | `device_hw_info.cpu_speed` | integer | Optional | The speed of the processor in Mhz. For Example: 4200.

| | `device_hw_info.cpu_type` | string | Optional | The processor type. For example: x86 Family 6 Model 37 Stepping 5.

| | `device_hw_info.desktop_display` | object | Optional | The desktop display affiliated with the event | | `device_hw_info.desktop_display.color_depth` | integer | Optional | The numeric color depth. | | `device_hw_info.desktop_display.physical_height` | integer | Optional | The numeric physical height of display. | | `device_hw_info.desktop_display.physical_orientation` | integer | Optional | The numeric physical orientation of display. | | `device_hw_info.desktop_display.physical_width` | integer | Optional | The numeric physical width of display. | | `device_hw_info.desktop_display.scale_factor` | integer | Optional | The numeric scale factor of display. | | `device_hw_info.keyboard_info` | object | Optional | The keyboard detailed information. | | `device_hw_info.keyboard_info.function_keys` | integer | Optional | The number of function keys on client keyboard. | | `device_hw_info.keyboard_info.ime` | string | Optional | The Input Method Editor (IME) file name. | | `device_hw_info.keyboard_info.keyboard_layout` | string | Optional | The keyboard locale identifier name (e.g., en-US). | | `device_hw_info.keyboard_info.keyboard_subtype` | integer | Optional | The keyboard numeric code. | | `device_hw_info.keyboard_info.keyboard_type` | string | Optional | The keyboard type (e.g., xt, ico). | | `device_hw_info.ram_size` | integer | Optional | The ctotal amount of installed RAM, in Megabytes. For example: 2048.

| | `device_hw_info.serial_number` | string | Optional | The device manufacturer serial number. | ### Input Example `{"device_hw_info":{"bios_date":"string","bios_manufacturer":"string","bios_ver":"string","chassis":"string","cpu_bits":123,"cpu_cores":123,"cpu_count":123,"cpu_speed":123,"cpu_type":"string","desktop_display":{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123},"keyboard_info":{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":123,"keyboard_type":"string"},"ram_size":123,"serial_number":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `bios_date` | string | The BIOS date. For example: 03/31/16.

| | `bios_manufacturer` | string | The BIOS manufacturer. For example: LENOVO.

| | `bios_ver` | string | The BIOS version. For example: LENOVO G5ETA2WW (2.62).

| | `chassis` | string | The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows [https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure](https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-systemenclosure)Windows Chassis Types
| | `cpu_bits` | integer | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `cpu_cores` | integer | The number of processor cores in all installed processors. For Example: 42.

| | `cpu_count` | integer | The number of physical processors on a system. For example: 1.

| | `cpu_speed` | integer | The speed of the processor in Mhz. For Example: 4200.

| | `cpu_type` | string | The processor type. For example: x86 Family 6 Model 37 Stepping 5.

| | `desktop_display` | object | The desktop display affiliated with the event | | `desktop_display.color_depth` | integer | The numeric color depth. | | `desktop_display.physical_height` | integer | The numeric physical height of display. | | `desktop_display.physical_orientation` | integer | The numeric physical orientation of display. | | `desktop_display.physical_width` | integer | The numeric physical width of display. | | `desktop_display.scale_factor` | integer | The numeric scale factor of display. | | `keyboard_info` | object | The keyboard detailed information. | | `keyboard_info.function_keys` | integer | The number of function keys on client keyboard. | | `keyboard_info.ime` | string | The Input Method Editor (IME) file name. | | `keyboard_info.keyboard_layout` | string | The keyboard locale identifier name (e.g., en-US). | | `keyboard_info.keyboard_subtype` | integer | The keyboard numeric code. | | `keyboard_info.keyboard_type` | string | The keyboard type (e.g., xt, ico). | | `ram_size` | integer | The ctotal amount of installed RAM, in Megabytes. For example: 2048.

| | `serial_number` | string | The device manufacturer serial number. | ### Output Example `{"bios_date":"string","bios_manufacturer":"string","bios_ver":"string","chassis":"string","cpu_bits":123,"cpu_cores":123,"cpu_count":123,"cpu_speed":123,"cpu_type":"string","desktop_display":{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123},"keyboard_info":{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":123,"keyboard_type":"string"},"ram_size":123,"serial_number":"string"}` ## Digital Signature Validates the digital signature provided as input to ensure authenticity and integrity of data. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------ | | `digital_signature` | object | Required | Parameter for Digital Signature | | `digital_signature.company_name` | string | Required | The name of the company that published the file. For example: Microsoft Corporation.

| | `digital_signature.created_time_dt` | string | Optional | The time when the digital signature was created. | | `digital_signature.developer_uid` | string | Optional | The developer ID on the certificate that signed the file. | | `digital_signature.fingerprints` | array | Optional | An array of digital fingerprint objects. | | `digital_signature.fingerprints.algorithm` | string | Optional | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `digital_signature.fingerprints.value` | string | Required | The digital fingerprint value. | | `digital_signature.issuer_name` | string | Optional | The certificate issuer name. | | `digital_signature.serial_number` | string | Optional | The serial number of the digital signature. | ### Input Example `{"digital_signature":{"company_name":"Example Name","created_time_dt":"string","developer_uid":"string","fingerprints":[{"algorithm":"string","value":"string"}],"issuer_name":"Example Name","serial_number":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------------------------------------------------------------------------ | | `company_name` | string | The name of the company that published the file. For example: Microsoft Corporation.

| | `created_time_dt` | string | The time when the digital signature was created. | | `developer_uid` | string | The developer ID on the certificate that signed the file. | | `fingerprints` | array | An array of digital fingerprint objects. | | `fingerprints.algorithm` | string | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `fingerprints.value` | string | The digital fingerprint value. | | `issuer_name` | string | The certificate issuer name. | | `serial_number` | string | The serial number of the digital signature. | ### Output Example `{"company_name":"string","created_time_dt":"string","developer_uid":"string","fingerprints":[],"issuer_name":"string","serial_number":"string"}` ## Display Renders the specified object from SOS Objects Pt1 for user visualization, requiring a 'display' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | -------------------------------------------- | | `display` | object | Required | Parameter for Display | | `display.color_depth` | integer | Optional | The numeric color depth. | | `display.physical_height` | integer | Optional | The numeric physical height of display. | | `display.physical_orientation` | integer | Optional | The numeric physical orientation of display. | | `display.physical_width` | integer | Optional | The numeric physical width of display. | | `display.scale_factor` | integer | Optional | The numeric scale factor of display. | ### Input Example `{"display":{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------------------- | | `color_depth` | integer | The numeric color depth. | | `physical_height` | integer | The numeric physical height of display. | | `physical_orientation` | integer | The numeric physical orientation of display. | | `physical_width` | integer | The numeric physical width of display. | | `scale_factor` | integer | The numeric scale factor of display. | ### Output Example `{"color_depth":123,"physical_height":123,"physical_orientation":123,"physical_width":123,"scale_factor":123}` ## Email Initiates the sending of an email through SOS Objects Pt1, requiring the recipient's email address as input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `email` | object | Required | Parameter for Email | | `email.cc` | array | Optional | The email header Cc values, as defined by RFC 5322. | | `email.contains` | array | Optional | Lists of observables contained within this observable | | `email.contains.enrichments` | array | Optional | A list of enrichments | | `email.contains.enrichments.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `email.contains.enrichments.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `email.contains.enrichments.provider` | string | Optional | The enrichment data provider name. | | `email.contains.enrichments.type` | string | Optional | The enrichment type. For example: location | | `email.contains.enrichments.value` | object | Optional | The value of the attribute to which the enriched data pertains. | | `email.contains.name` | string | Optional | The name of the observable attribute. For example: file.name.

| | `email.contains.type` | string | Required | The observable value type name. | | `email.contains.value` | object | Optional | The value associated with the observable attribute. The meaning of the data depends on the observable type. | | `email.content_type` | string | Optional | The request header that identifies the original [https://www.iana.org/assignments/media-types/media-types.xhtml](https://www.iana.org/assignments/media-types/media-types.xhtml)media type of the resource (prior to any content encoding applied for sending).
| | `email.delivered_to` | string | Optional | The ****Delivered-To email header field.
| | `email.direction` | string | Optional | The direction of the email, as defined by the direction\_id value.

| | `email.from` | string | Required | The email header From values, as defined by RFC 5322. | | `email.message_uid` | string | Optional | The email header Message-Id value, as defined by RFC 5322. | | `email.mime_parts` | array | Optional | MIME parts of an email | | `email.mime_parts.content` | object | Optional | Contents of the MIME part | | `email.mime_parts.content.description` | string | Optional | Response content | | `email.mime_parts.content.file` | string | Optional | Response content | | `email.mime_parts.content.file_name` | string | Optional | Name of the resource | | `email.mime_parts.content_disposition` | string | Optional | Value of the Content-Disposition header field of the MIME part | | `email.mime_parts.content_text` | string | Optional | Text Contents of the MIME part | | `email.mime_parts.content_type` | string | Optional | Value of the Content-Type header field of the MIME part | ### Input Example `{"email":{"cc":["string"],"contains":[{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}],"content_type":"string","delivered_to":"string","direction":"string","from":"string","message_uid":"string","mime_parts":[{"content":{"description":"string","file":"string","file_name":"Example Name"},"content_disposition":"string","content_text":"string","content_type":"string"}],"reply_to":"string","size":123,"smtp_from":"string","smtp_headers":[{"name":"Example Name","value":{}}],"smtp_hello":"string","smtp_to":["string"],"subject":"string","to":["string"],"x_originating_ip":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cc` | array | The email header Cc values, as defined by RFC 5322. | | `contains` | array | Lists of observables contained within this observable | | `contains.enrichments` | array | A list of enrichments | | `contains.enrichments.data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `contains.enrichments.name` | string | The name of the attribute to which the enriched data pertains. | | `contains.enrichments.provider` | string | The enrichment data provider name. | | `contains.enrichments.type` | string | The enrichment type. For example: location | | `contains.enrichments.value` | object | The value of the attribute to which the enriched data pertains. | | `contains.name` | string | The name of the observable attribute. For example: file.name.

| | `contains.type` | string | The observable value type name. | | `contains.value` | object | The value associated with the observable attribute. The meaning of the data depends on the observable type. | | `content_type` | string | The request header that identifies the original [https://www.iana.org/assignments/media-types/media-types.xhtml](https://www.iana.org/assignments/media-types/media-types.xhtml)media type of the resource (prior to any content encoding applied for sending).
| | `delivered_to` | string | The ****Delivered-To email header field.
| | `direction` | string | The direction of the email, as defined by the direction\_id value.

| | `from` | string | The email header From values, as defined by RFC 5322. | | `message_uid` | string | The email header Message-Id value, as defined by RFC 5322. | | `mime_parts` | array | MIME parts of an email | | `mime_parts.content` | object | Contents of the MIME part | | `mime_parts.content.description` | string | Response content | | `mime_parts.content.file` | string | Response content | | `mime_parts.content.file_name` | string | Name of the resource | | `mime_parts.content_disposition` | string | Value of the Content-Disposition header field of the MIME part | | `mime_parts.content_text` | string | Text Contents of the MIME part | | `mime_parts.content_type` | string | Value of the Content-Type header field of the MIME part | | `reply_to` | string | The email header Reply-To values, as defined by RFC 5322. | ### Output Example `{"cc":[],"contains":[],"content_type":"string","delivered_to":"string","direction":"string","from":"string","message_uid":"string","mime_parts":[],"reply_to":"string","size":123,"smtp_from":"string","smtp_headers":[],"smtp_hello":"string","smtp_to":[],"subject":"string"}` ## Email Authentication Authenticate using an email address to enable further actions within the SOS Objects Pt1 service. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------- | | `email_auth` | object | Required | Parameter for Email Authentication | | `email_auth.dkim` | string | Optional | The DomainKeys Identified Mail (DKIM) status of the email. | | `email_auth.dkim_domain` | string | Optional | The DomainKeys Identified Mail (DKIM) signing domain of the email. | | `email_auth.dmarc` | string | Optional | The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email. | | `email_auth.dmarc_override` | string | Optional | The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action. | | `email_auth.dmarc_policy` | string | Optional | The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status. | | `email_auth.raw_header` | string | Optional | The email authentication header. | | `email_auth.spf` | string | Optional | The Sender Policy Framework (SPF) status of the email. | ### Input Example `{"email_auth":{"dkim":"string","dkim_domain":"string","dmarc":"string","dmarc_override":"string","dmarc_policy":"string","raw_header":"string","spf":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------------------------------------------------------------------------------- | | `dkim` | string | The DomainKeys Identified Mail (DKIM) status of the email. | | `dkim_domain` | string | The DomainKeys Identified Mail (DKIM) signing domain of the email. | | `dmarc` | string | The Domain-based Message Authentication, Reporting and Conformance (DMARC) status of the email. | | `dmarc_override` | string | The Domain-based Message Authentication, Reporting and Conformance (DMARC) override action. | | `dmarc_policy` | string | The Domain-based Message Authentication, Reporting and Conformance (DMARC) policy status. | | `raw_header` | string | The email authentication header. | | `spf` | string | The Sender Policy Framework (SPF) status of the email. | ### Output Example `{"dkim":"string","dkim_domain":"string","dmarc":"string","dmarc_override":"string","dmarc_policy":"string","raw_header":"string","spf":"string"}` ## Enrichment Enrich data by adding contextual information to SOS Objects Pt1 entities, requiring an 'enrichment' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------- | | `enrichment` | object | Required | Parameter for Enrichment | | `enrichment.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `enrichment.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `enrichment.provider` | string | Optional | The enrichment data provider name. | | `enrichment.type` | string | Optional | The enrichment type. For example: location | | `enrichment.value` | object | Optional | The value of the attribute to which the enriched data pertains. | ### Input Example `{"enrichment":{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------- | | `data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `name` | string | The name of the attribute to which the enriched data pertains. | | `provider` | string | The enrichment data provider name. | | `type` | string | The enrichment type. For example: location | | `value` | object | The value of the attribute to which the enriched data pertains. | ### Output Example `{"data":{},"name":"string","provider":"string","type":"string","value":{}}` ## Feature Initiate the 'feature' action within SOS Objects Pt1, requiring a specific feature input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------- | | `feature` | object | Required | Parameter for Feature | | `feature.name` | string | Optional | The name of the product feature. | | `feature.uid` | string | Optional | The unique identifier of the product feature. | | `feature.version` | string | Optional | The version of the product feature. | ### Input Example `{"feature":{"name":"Example Name","uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | --------------------------------------------- | | `name` | string | The name of the product feature. | | `uid` | string | The unique identifier of the product feature. | | `version` | string | The version of the product feature. | ### Output Example `{"name":"string","uid":"string","version":"string"}` ## File Upload a specified file to SOS Objects Pt1, requiring the file as mandatory input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `file` | object | Required | Parameter for File | | `file.accessed_time_dt` | string | Optional | The time when the file was last accessed. | | `file.accessor` | string | Optional | The name of the user who last accessed the object. | | `file.attributes` | integer | Optional | The bitmask value that represents the file attributes. | | `file.company_name` | string | Optional | The name of the company that published the file. For example: Microsoft Corporation.

| | `file.confidentiality` | string | Optional | The file content confidentiality, as defined by the event source. | | `file.created_time_dt` | string | Optional | The time when the file was created. | | `file.creator` | string | Optional | The user that created the file. | | `file.desc` | string | Optional | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `file.fingerprints` | array | Optional | An array of digital fingerprint objects. | | `file.fingerprints.algorithm` | string | Optional | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `file.fingerprints.value` | string | Required | The digital fingerprint value. | | `file.is_system` | boolean | Optional | The indication of whether the object is part of the operating system. | | `file.mime_type` | string | Optional | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `file.modified_time_dt` | string | Optional | The time when the file was last modified. | | `file.modifier` | string | Optional | The user that last modified the file. | | `file.name` | string | Required | The name of the file. For example: svchost.exe

| | `file.owner` | string | Optional | The user that owns the file/object. | | `file.parent_folder` | string | Optional | The parent folder in which the file resides. For example: c:\windows\system32

| | `file.path` | string | Optional | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `file.product` | object | Optional | The product that created or installed the file. | | `file.product.feature` | object | Optional | The feature that reported the event. | | `file.product.feature.name` | string | Optional | The name of the product feature. | | `file.product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `file.product.feature.version` | string | Optional | The version of the product feature. | ### Input Example `{"file":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[{"algorithm":"string","value":"string"}],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"security_descriptor":"string","signature":{"company_name":"Example Name","created_time_dt":"string","developer_uid":"string","fingerprints":[{"algorithm":"string","value":"string"}],"issuer_name":"Example Name","serial_number":"string"},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `accessed_time_dt` | string | The time when the file was last accessed. | | `accessor` | string | The name of the user who last accessed the object. | | `attributes` | integer | The bitmask value that represents the file attributes. | | `company_name` | string | The name of the company that published the file. For example: Microsoft Corporation.

| | `confidentiality` | string | The file content confidentiality, as defined by the event source. | | `created_time_dt` | string | The time when the file was created. | | `creator` | string | The user that created the file. | | `desc` | string | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `fingerprints` | array | An array of digital fingerprint objects. | | `fingerprints.algorithm` | string | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `fingerprints.value` | string | The digital fingerprint value. | | `is_system` | boolean | The indication of whether the object is part of the operating system. | | `mime_type` | string | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `modified_time_dt` | string | The time when the file was last modified. | | `modifier` | string | The user that last modified the file. | | `name` | string | The name of the file. For example: svchost.exe

| | `owner` | string | The user that owns the file/object. | | `parent_folder` | string | The parent folder in which the file resides. For example: c:\windows\system32

| | `path` | string | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `product` | object | The product that created or installed the file. | | `product.feature` | object | The feature that reported the event. | | `product.feature.name` | string | The name of the product feature. | | `product.feature.uid` | string | The unique identifier of the product feature. | | `product.feature.version` | string | The version of the product feature. | | `product.lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| ### Output Example `{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"string","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"string","owner":"string"}` ## Finding Details Retrieve detailed information for a specified 'finding' within the SOS Objects Pt1 service. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------- | | `finding` | object | Required | Parameter for Finding Details | | `finding.created_time_dt` | string | Optional | The time when the finding was created. | | `finding.desc` | string | Optional | The description of the reported finding. | | `finding.first_seen_time_dt` | string | Optional | The time when the finding was first observed. | | `finding.last_seen_time_dt` | string | Optional | The time when the finding was most recently observed. | | `finding.log_sources` | array | Optional | The Sources of the Events generating the Finding | | `finding.log_sources.name` | string | Optional | The name of the entity. See specific usage. | | `finding.log_sources.type` | string | Optional | The type of an object or value, as defined by the event source. See specific usage. | | `finding.modified_time_dt` | string | Optional | The time when the finding was last modified. | | `finding.product_uid` | string | Optional | The unique identifier of the product that reported the finding. | | `finding.related_events` | object | Optional | Describes events related to a finding or detection as identified by the security product. | | `finding.remediation` | object | Optional | The remediation recommendations on how to fix the identified issue(s). | | `finding.remediation.desc` | string | Optional | The description of the remediation strategy. | | `finding.remediation.kb_articles` | array | Optional | The KB article/s related to the entity | | `finding.rules` | array | Optional | The rules that reported the events. | | `finding.rules.category` | string | Optional | The rule category. | | `finding.rules.desc` | string | Optional | The description of the rule that generated the event. | | `finding.rules.name` | string | Required | The name of the rule that generated the event. | | `finding.rules.type` | string | Optional | The rule type. | | `finding.rules.uid` | string | Optional | The unique identifier of the rule that generated the event. | | `finding.rules.version` | string | Optional | The rule version. For example: 1.1.

| | `finding.src_url` | string | Optional | The URL pointing to the source of the finding. | | `finding.supporting_data` | array | Optional | Additional data supporting a finding as provided by security tool | | `finding.title` | string | Required | The title of the reported finding. | | `finding.types` | array | Optional | One or more types of the reported finding. | ### Input Example `{"finding":{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[{"name":"Example Name","type":"string"}],"modified_time_dt":"string","product_uid":"string","related_events":{},"remediation":{"desc":"string","kb_articles":["string"]},"rules":[{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}],"src_url":"string","supporting_data":[],"title":"string","types":["string"],"uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ----------------------------------------------------------------------------------------- | | `created_time_dt` | string | The time when the finding was created. | | `desc` | string | The description of the reported finding. | | `first_seen_time_dt` | string | The time when the finding was first observed. | | `last_seen_time_dt` | string | The time when the finding was most recently observed. | | `log_sources` | array | The Sources of the Events generating the Finding | | `log_sources.name` | string | The name of the entity. See specific usage. | | `log_sources.type` | string | The type of an object or value, as defined by the event source. See specific usage. | | `modified_time_dt` | string | The time when the finding was last modified. | | `product_uid` | string | The unique identifier of the product that reported the finding. | | `related_events` | object | Describes events related to a finding or detection as identified by the security product. | | `remediation` | object | The remediation recommendations on how to fix the identified issue(s). | | `remediation.desc` | string | The description of the remediation strategy. | | `remediation.kb_articles` | array | The KB article/s related to the entity | | `rules` | array | The rules that reported the events. | | `rules.category` | string | The rule category. | | `rules.desc` | string | The description of the rule that generated the event. | | `rules.name` | string | The name of the rule that generated the event. | | `rules.type` | string | The rule type. | | `rules.uid` | string | The unique identifier of the rule that generated the event. | | `rules.version` | string | The rule version. For example: 1.1.

| | `src_url` | string | The URL pointing to the source of the finding. | | `supporting_data` | array | Additional data supporting a finding as provided by security tool | | `title` | string | The title of the reported finding. | | `types` | array | One or more types of the reported finding. | | `uid` | string | The unique identifier of the reported finding. | ### Output Example `{"created_time_dt":"string","desc":"string","first_seen_time_dt":"string","last_seen_time_dt":"string","log_sources":[],"modified_time_dt":"string","product_uid":"string","remediation":{"desc":"string","kb_articles":["string"]},"rules":[],"src_url":"string","supporting_data":[],"title":"string","types":[],"uid":"string"}` ## Fingerprint Generates a unique fingerprint for SOS Objects Pt1 based on the provided input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------ | | `fingerprint` | object | Required | Parameter for Fingerprint | | `fingerprint.algorithm` | string | Optional | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `fingerprint.value` | string | Required | The digital fingerprint value. | ### Input Example `{"fingerprint":{"algorithm":"string","value":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------------------------------------------------------------------------ | | `algorithm` | string | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `value` | string | The digital fingerprint value. | ### Output Example `{"algorithm":"string","value":"string"}` ## Group Groups objects in SOS Objects Pt1 based on specified criteria, requiring a 'group' parameter. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `group` | object | Required | Parameter for Group | | `group.desc` | string | Optional | The group description. | | `group.name` | string | Required | The group name. | | `group.privileges` | array | Optional | The group privileges. | | `group.type` | string | Optional | The type of the group or account. | | `group.uid` | string | Optional | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | ### Input Example `{"group":{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------- | | `desc` | string | The group description. | | `name` | string | The group name. | | `privileges` | array | The group privileges. | | `type` | string | The type of the group or account. | | `uid` | string | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | ### Output Example `{"desc":"string","name":"string","privileges":[],"type":"string","uid":"string"}` ## Image Retrieve an image from SOS Objects Pt1 using the specified image identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------- | | `image` | object | Required | Parameter for Image | | `image.labels` | array | Optional | The image labels. | | `image.name` | string | Optional | The image name. For example: elixir.

| | `image.path` | string | Optional | The full path to the image file. | | `image.tag` | string | Optional | The image tag. For example: 1.11-alpine.

| | `image.uid` | string | Required | The unique image ID. For example: 77af4d6b9913.

| ### Input Example `{"image":{"labels":["string"],"name":"Example Name","path":"string","tag":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------------------------------------------- | | `labels` | array | The image labels. | | `name` | string | The image name. For example: elixir.

| | `path` | string | The full path to the image file. | | `tag` | string | The image tag. For example: 1.11-alpine.

| | `uid` | string | The unique image ID. For example: 77af4d6b9913.

| ### Output Example `{"labels":[],"name":"string","path":"string","tag":"string","uid":"string"}` ## Keyboard Information Retrieve detailed information about the keyboard setup from SOS Objects Pt1. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | -------------------------------------------------- | | `keyboard_info` | object | Required | Parameter for Keyboard Information | | `keyboard_info.function_keys` | integer | Optional | The number of function keys on client keyboard. | | `keyboard_info.ime` | string | Optional | The Input Method Editor (IME) file name. | | `keyboard_info.keyboard_layout` | string | Optional | The keyboard locale identifier name (e.g., en-US). | | `keyboard_info.keyboard_subtype` | integer | Optional | The keyboard numeric code. | | `keyboard_info.keyboard_type` | string | Optional | The keyboard type (e.g., xt, ico). | ### Input Example `{"keyboard_info":{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":123,"keyboard_type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------------------------- | | `function_keys` | integer | The number of function keys on client keyboard. | | `ime` | string | The Input Method Editor (IME) file name. | | `keyboard_layout` | string | The keyboard locale identifier name (e.g., en-US). | | `keyboard_subtype` | integer | The keyboard numeric code. | | `keyboard_type` | string | The keyboard type (e.g., xt, ico). | ### Output Example `{"function_keys":123,"ime":"string","keyboard_layout":"string","keyboard_subtype":123,"keyboard_type":"string"}` ## Geo Location Retrieve the specified location details from SOS Objects Pt1 using the provided location identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `location` | object | Required | Parameter for Geo Location | | `location.city` | string | Optional | The name of the city. | | `location.continent` | string | Optional | The name of the continent. | | `location.coordinates` | array | Required | A two-element array, containing a longitude/latitude pair. The format conforms with [https://geojson.org](https://geojson.org)GeoJSON. For example: \[-73.983, 40.719].


| | `location.country` | string | Optional | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see [https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en](https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en)ISO 3166-1 alpha-2 codes.****Note: The two letter country code should be capitalized. For example: US or CA.







| | `location.desc` | string | Optional | The description of the geographical location. | | `location.is_on_premises` | boolean | Optional | The indication of whether the location is on premises. | | `location.isp` | string | Optional | The name of the Internet Service Provider (ISP). | | `location.postal_code` | string | Optional | The postal code of the location. | | `location.provider` | string | Optional | The provider of the geographical location data. | | `location.region` | string | Optional | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at [https://www.iso.org/iso-3166-country-codes.html](https://www.iso.org/iso-3166-country-codes.html)ISO 3166-2 and have a limit of three characters. For example, see [https://www.iso.org/obp/ui/#iso\:code:3166\:US](https://www.iso.org/obp/ui/#iso\:code:3166\:US)the region codes for the US.

| ### Input Example `{"location":{"city":"string","continent":"string","coordinates":[123],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `city` | string | The name of the city. | | `continent` | string | The name of the continent. | | `coordinates` | array | A two-element array, containing a longitude/latitude pair. The format conforms with [https://geojson.org](https://geojson.org)GeoJSON. For example: \[-73.983, 40.719].


| | `country` | string | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see [https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en](https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en)ISO 3166-1 alpha-2 codes.****Note: The two letter country code should be capitalized. For example: US or CA.







| | `desc` | string | The description of the geographical location. | | `is_on_premises` | boolean | The indication of whether the location is on premises. | | `isp` | string | The name of the Internet Service Provider (ISP). | | `postal_code` | string | The postal code of the location. | | `provider` | string | The provider of the geographical location data. | | `region` | string | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at [https://www.iso.org/iso-3166-country-codes.html](https://www.iso.org/iso-3166-country-codes.html)ISO 3166-2 and have a limit of three characters. For example, see [https://www.iso.org/obp/ui/#iso\:code:3166\:US](https://www.iso.org/obp/ui/#iso\:code:3166\:US)the region codes for the US.

| ### Output Example `{"city":"string","continent":"string","coordinates":[],"country":"string","desc":"string","is_on_premises":true,"isp":"string","postal_code":"string","provider":"string","region":"string"}` ## Log Source Retrieve and manage log source information from SOS Objects Pt1, requiring a specified log source identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------------------- | | `log_source` | object | Required | Parameter for Log Source | | `log_source.name` | string | Optional | The name of the entity. See specific usage. | | `log_source.type` | string | Optional | The type of an object or value, as defined by the event source. See specific usage. | ### Input Example `{"log_source":{"name":"Example Name","type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------------------------------------------------------------------- | | `name` | string | The name of the entity. See specific usage. | | `type` | string | The type of an object or value, as defined by the event source. See specific usage. | ### Output Example `{"name":"string","type":"string"}` ## Malware Initiate a malware analysis using the provided malware object within SOS Objects Pt1. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `malware` | object | Required | Parameter for Malware | | `malware.classifications` | array | Optional | The list of malware classifications, as defined by the event source. | | `malware.cves` | array | Optional | List of Common Vulnerabilities and Exposures ([https://cve.mitre.org/](https://cve.mitre.org/)CVE).
| | `malware.cves.created_time_dt` | string | Optional | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `malware.cves.cvss` | object | Optional | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `malware.cves.cvss.base_score` | number | Required | The CVSS base score. For example: 9.1.

| | `malware.cves.cvss.depth` | string | Optional | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `malware.cves.cvss.metrics` | array | Optional | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `malware.cves.cvss.metrics.name` | string | Required | The name of the metric. | | `malware.cves.cvss.metrics.value` | object | Required | The value of the metric. | | `malware.cves.cvss.overall_score` | number | Optional | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `malware.cves.cvss.severity` | string | Optional | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `malware.cves.cvss.vector_string` | string | Optional | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `malware.cves.cvss.version` | string | Required | The CVSS version. For example: 3.1.

| | `malware.cves.cwe_uid` | string | Optional | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `malware.cves.cwe_url` | string | Optional | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `malware.cves.modified_time_dt` | string | Optional | The Record Modified Date identifies when the CVE record was last updated. | | `malware.cves.product` | object | Optional | The product where the vulnerability was discovered. | | `malware.cves.product.feature` | object | Optional | The feature that reported the event. | | `malware.cves.product.feature.name` | string | Optional | The name of the product feature. | | `malware.cves.product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `malware.cves.product.feature.version` | string | Optional | The version of the product feature. | | `malware.cves.product.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `malware.cves.product.name` | string | Required | The name of the product. | | `malware.cves.product.path` | string | Optional | The installation path of the product. | ### Input Example `{"malware":{"classifications":["string"],"cves":[{"created_time_dt":"string","cvss":{"base_score":123,"depth":"string","metrics":[],"overall_score":123,"severity":"string","vector_string":"string","version":"string"},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"type":"string","uid":"string"}],"name":"Example Name","path":"string","provider":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `classifications` | array | The list of malware classifications, as defined by the event source. | | `cves` | array | List of Common Vulnerabilities and Exposures ([https://cve.mitre.org/](https://cve.mitre.org/)CVE).
| | `cves.created_time_dt` | string | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `cves.cvss` | object | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `cves.cvss.base_score` | number | The CVSS base score. For example: 9.1.

| | `cves.cvss.depth` | string | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `cves.cvss.metrics` | array | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `cves.cvss.metrics.name` | string | The name of the metric. | | `cves.cvss.metrics.value` | object | The value of the metric. | | `cves.cvss.overall_score` | number | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `cves.cvss.severity` | string | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `cves.cvss.vector_string` | string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `cves.cvss.version` | string | The CVSS version. For example: 3.1.

| | `cves.cwe_uid` | string | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `cves.cwe_url` | string | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `cves.modified_time_dt` | string | The Record Modified Date identifies when the CVE record was last updated. | | `cves.product` | object | The product where the vulnerability was discovered. | | `cves.product.feature` | object | The feature that reported the event. | | `cves.product.feature.name` | string | The name of the product feature. | | `cves.product.feature.uid` | string | The unique identifier of the product feature. | | `cves.product.feature.version` | string | The version of the product feature. | | `cves.product.lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `cves.product.name` | string | The name of the product. | | `cves.product.path` | string | The installation path of the product. | | `cves.product.uid` | string | The unique identifier of the product. | ### Output Example `{"classifications":[],"cves":[],"name":"string","path":"string","provider":"string","uid":"string"}` ## Metadata Obtain metadata details for a specific object within the SOS Objects Pt1 service. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `metadata` | object | Required | Response data | | `metadata.correlation_uid` | string | Optional | The unique identifier used to correlate events. | | `metadata.labels` | array | Optional | The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.For example: \["network", "connection.ip\:destination", "device.ip\:source"]


| | `metadata.logged_time_dt` | string | Optional | The time when the logging system collected and logged the event.This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
| | `metadata.modified_time_dt` | string | Optional | The time when the event was last modified or enriched. | | `metadata.original_time` | string | Optional | The original event time as reported by the event source. | | `metadata.processed_time_dt` | string | Optional | The event processed time, such as an ETL operation. | | `metadata.product` | object | Required | The product that reported the event. | | `metadata.product.feature` | object | Optional | The feature that reported the event. | | `metadata.product.feature.name` | string | Optional | The name of the product feature. | | `metadata.product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `metadata.product.feature.version` | string | Optional | The version of the product feature. | | `metadata.product.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `metadata.product.name` | string | Required | The name of the product. | | `metadata.product.path` | string | Optional | The installation path of the product. | | `metadata.product.uid` | string | Optional | The unique identifier of the product. | | `metadata.product.vendor_name` | string | Required | The name of the vendor of the product. | | `metadata.product.version` | string | Optional | The version of the product, as defined by the event source. For example: 2013.1.3-beta.

| | `metadata.profiles` | array | Optional | The list of profiles used to create the event. | | `metadata.sequence` | integer | Optional | Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision. | | `metadata.uid` | string | Optional | The logging system-assigned unique identifier of an event instance. | | `metadata.version` | string | Required | The version of the event class, using Semantic Versioning Specification ([https://semver.org](https://semver.org)SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.
| ### Input Example `{"metadata":{"correlation_uid":"string","labels":["string"],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":["string"],"sequence":123,"uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `correlation_uid` | string | The unique identifier used to correlate events. | | `labels` | array | The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time.For example: \["network", "connection.ip\:destination", "device.ip\:source"]


| | `logged_time_dt` | string | The time when the logging system collected and logged the event.This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different.
| | `modified_time_dt` | string | The time when the event was last modified or enriched. | | `original_time` | string | The original event time as reported by the event source. | | `processed_time_dt` | string | The event processed time, such as an ETL operation. | | `product` | object | The product that reported the event. | | `product.feature` | object | The feature that reported the event. | | `product.feature.name` | string | The name of the product feature. | | `product.feature.uid` | string | The unique identifier of the product feature. | | `product.feature.version` | string | The version of the product feature. | | `product.lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `product.name` | string | The name of the product. | | `product.path` | string | The installation path of the product. | | `product.uid` | string | The unique identifier of the product. | | `product.vendor_name` | string | The name of the vendor of the product. | | `product.version` | string | The version of the product, as defined by the event source. For example: 2013.1.3-beta.

| | `profiles` | array | The list of profiles used to create the event. | | `sequence` | integer | Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision. | | `uid` | string | The logging system-assigned unique identifier of an event instance. | | `version` | string | The version of the event class, using Semantic Versioning Specification ([https://semver.org](https://semver.org)SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.
| ### Output Example `{"correlation_uid":"string","labels":[],"logged_time_dt":"string","modified_time_dt":"string","original_time":"string","processed_time_dt":"string","product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"profiles":[],"sequence":123,"uid":"string","version":"string"}` ## Metric Retrieve a specific metric from SOS Objects Pt1 by providing the required metric input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------ | | `metric` | object | Required | Parameter for Metric | | `metric.name` | string | Required | The name of the metric. | | `metric.value` | object | Required | The value of the metric. | ### Input Example `{"metric":{"name":"Example Name","value":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------ | | `name` | string | The name of the metric. | | `value` | object | The value of the metric. | ### Output Example `{"name":"string","value":{}}` ## MIME Part Extracts the specified MIME part from an email object within SOS Objects Pt1, requiring the 'mime\_part' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | -------------------------------------------------------------- | | `mime_part` | object | Required | Parameter for MIME Part | | `mime_part.content` | object | Optional | Contents of the MIME part | | `mime_part.content.description` | string | Optional | Response content | | `mime_part.content.file` | string | Optional | Response content | | `mime_part.content.file_name` | string | Optional | Name of the resource | | `mime_part.content_disposition` | string | Optional | Value of the Content-Disposition header field of the MIME part | | `mime_part.content_text` | string | Optional | Text Contents of the MIME part | | `mime_part.content_type` | string | Optional | Value of the Content-Type header field of the MIME part | ### Input Example `{"mime_part":{"content":{"description":"string","file":"string","file_name":"Example Name"},"content_disposition":"string","content_text":"string","content_type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------------------------------------- | | `content` | object | Contents of the MIME part | | `content.description` | string | Response content | | `content.file` | string | Response content | | `content.file_name` | string | Name of the resource | | `content_disposition` | string | Value of the Content-Disposition header field of the MIME part | | `content_text` | string | Text Contents of the MIME part | | `content_type` | string | Value of the Content-Type header field of the MIME part | ### Output Example `{"content":{"description":"string","file":"string","file_name":"Example Name"},"content_disposition":"string","content_text":"string","content_type":"string"}` ## Network Interface Retrieve details for a specified network interface from SOS Objects Pt1, requiring the network\_interface identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------- | | `network_interface` | object | Required | Parameter for Network Interface | | `network_interface.hostname` | string | Optional | The hostname associated with the network interface. | | `network_interface.ip` | string | Optional | The IP address associated with the network interface. | | `network_interface.mac` | string | Optional | The MAC address of the network interface. | | `network_interface.name` | string | Optional | The name of the network interface. | | `network_interface.namespace` | string | Optional | The namespace is useful in merger or acquisition situations. For example, when similar entities exists that you need to keep separate. | | `network_interface.reputation` | object | Optional | Contains the original and normalized reputation scores. | | `network_interface.reputation.base_score` | number | Required | The reputation score as reported by the event source. | | `network_interface.reputation.provider` | string | Optional | The provider of the reputation information. | | `network_interface.reputation.score` | string | Optional | The reputation score, as defined by the event source. | | `network_interface.type` | string | Optional | The type of network interface. | | `network_interface.uid` | string | Optional | The unique identifier for the network interface. | ### Input Example `{"network_interface":{"hostname":"Example Name","ip":"string","mac":"string","name":"Example Name","namespace":"Example Name","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `hostname` | string | The hostname associated with the network interface. | | `ip` | string | The IP address associated with the network interface. | | `mac` | string | The MAC address of the network interface. | | `name` | string | The name of the network interface. | | `namespace` | string | The namespace is useful in merger or acquisition situations. For example, when similar entities exists that you need to keep separate. | | `reputation` | object | Contains the original and normalized reputation scores. | | `reputation.base_score` | number | The reputation score as reported by the event source. | | `reputation.provider` | string | The provider of the reputation information. | | `reputation.score` | string | The reputation score, as defined by the event source. | | `type` | string | The type of network interface. | | `uid` | string | The unique identifier for the network interface. | ### Output Example `{"hostname":"string","ip":"string","mac":"string","name":"string","namespace":"string","reputation":{"base_score":123,"provider":"string","score":"string"},"type":"string","uid":"string"}` ## Object Retrieve details for a specified object within the SOS Objects Pt1 service using the provided object identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------- | | `object` | object | Required | Parameter for Object | ### Input Example `{"object":{}}` ## Observable Retrieve details for a specified observable in SOS Objects Pt1 using the required 'observable' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------- | | `observable` | object | Required | Parameter for Observable | | `observable.enrichments` | array | Optional | A list of enrichments | | `observable.enrichments.data` | object | Required | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `observable.enrichments.name` | string | Optional | The name of the attribute to which the enriched data pertains. | | `observable.enrichments.provider` | string | Optional | The enrichment data provider name. | | `observable.enrichments.type` | string | Optional | The enrichment type. For example: location | | `observable.enrichments.value` | object | Optional | The value of the attribute to which the enriched data pertains. | | `observable.name` | string | Optional | The name of the observable attribute. For example: file.name.

| | `observable.type` | string | Required | The observable value type name. | | `observable.value` | object | Optional | The value associated with the observable attribute. The meaning of the data depends on the observable type. | ### Input Example `{"observable":{"enrichments":[{"data":{},"name":"Example Name","provider":"string","type":"string","value":{}}],"name":"Example Name","type":"string","value":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------- | | `enrichments` | array | A list of enrichments | | `enrichments.data` | object | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | | `enrichments.name` | string | The name of the attribute to which the enriched data pertains. | | `enrichments.provider` | string | The enrichment data provider name. | | `enrichments.type` | string | The enrichment type. For example: location | | `enrichments.value` | object | The value of the attribute to which the enriched data pertains. | | `name` | string | The name of the observable attribute. For example: file.name.

| | `type` | string | The observable value type name. | | `value` | object | The value associated with the observable attribute. The meaning of the data depends on the observable type. | ### Output Example `{"enrichments":[],"name":"string","type":"string","value":{}}` ## Organization Retrieve details for a specified organization within the SOS Objects Pt1 service using the required 'organization' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------------------------------------------------ | | `organization` | object | Required | Parameter for Organization | | `organization.data` | object | Optional | The additional data that is associated with the event or object. See specific usage. | | `organization.name` | string | Optional | Organization name | | `organization.sectors` | array | Optional | The list of industry sectors this organization belongs to | | `organization.uid` | string | Required | The unique identifier. See specific usage. | ### Input Example `{"organization":{"data":{},"name":"Example Name","sectors":["string"],"uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------------------------------------------------------ | | `data` | object | The additional data that is associated with the event or object. See specific usage. | | `name` | string | Organization name | | `sectors` | array | The list of industry sectors this organization belongs to | | `uid` | string | The unique identifier. See specific usage. | ### Output Example `{"data":{},"name":"string","sectors":[],"uid":"string"}` ## OS Retrieve operating system details from SOS Objects Pt1 using the specified 'os' parameter. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `os` | object | Required | Parameter for OS | | `os.build` | string | Optional | The operating system build number. | | `os.country` | string | Optional | The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see [https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en](https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en)ISO 3166-1 alpha-2 codes.
| | `os.cpu_bits` | integer | Optional | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `os.edition` | string | Optional | The operating system edition. For example: Professional.

| | `os.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `os.name` | string | Required | The operating system name. | | `os.sp_name` | string | Optional | The name of the latest Service Pack. | | `os.sp_ver` | integer | Optional | The version number of the latest Service Pack. | | `os.type` | string | Optional | The type of the operating system. | | `os.version` | string | Optional | The version of the OS running on the device that originated the event. For example: "Windows 10", "OS X 10.7", or "iOS 9". | ### Input Example `{"os":{"build":"string","country":"string","cpu_bits":123,"edition":"string","lang":"string","name":"Example Name","sp_name":"Example Name","sp_ver":123,"type":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `build` | string | The operating system build number. | | `country` | string | The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see [https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en](https://www.iso.org/obp/ui/#iso\:pub\:PUB500001\:en)ISO 3166-1 alpha-2 codes.
| | `cpu_bits` | integer | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.



| | `edition` | string | The operating system edition. For example: Professional.

| | `lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `name` | string | The operating system name. | | `sp_name` | string | The name of the latest Service Pack. | | `sp_ver` | integer | The version number of the latest Service Pack. | | `type` | string | The type of the operating system. | | `version` | string | The version of the OS running on the device that originated the event. For example: "Windows 10", "OS X 10.7", or "iOS 9". | ### Output Example `{"build":"string","country":"string","cpu_bits":123,"edition":"string","lang":"string","name":"string","sp_name":"string","sp_ver":123,"type":"string","version":"string"}` ## Software Package Create a new package in SOS Objects Pt1 using the specified package details provided by the user. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------- | | `package` | object | Required | Parameter for Software Package | | `package.architecture` | string | Optional | Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on. | | `package.epoch` | integer | Optional | The software package epoch. Epoch is a way to define weighted dependencies based on version numbers. | | `package.name` | string | Required | The software package name. | | `package.release` | string | Optional | Release is the number of times a version of the software has been packaged. | | `package.version` | string | Required | The software package version. | ### Input Example `{"package":{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------- | | `architecture` | string | Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on. | | `epoch` | integer | The software package epoch. Epoch is a way to define weighted dependencies based on version numbers. | | `name` | string | The software package name. | | `release` | string | Release is the number of times a version of the software has been packaged. | | `version` | string | The software package version. | ### Output Example `{"architecture":"string","epoch":123,"name":"string","release":"string","version":"string"}` ## Process Initiates the processing of data for SOS Objects Pt1, requiring a 'process' input to define the operation. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `process` | object | Required | Parameter for Process | | `process.cmd_line` | string | Optional | The full command line used to launch an application, service, process, or job. For example: ssh user\@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used



| | `process.created_time_dt` | string | Optional | The time when the process was created/started. | | `process.file_object` | object | Optional | The process file object. | | `process.file_object.accessed_time_dt` | string | Optional | The time when the file was last accessed. | | `process.file_object.accessor` | string | Optional | The name of the user who last accessed the object. | | `process.file_object.attributes` | integer | Optional | The bitmask value that represents the file attributes. | | `process.file_object.company_name` | string | Optional | The name of the company that published the file. For example: Microsoft Corporation.

| | `process.file_object.confidentiality` | string | Optional | The file content confidentiality, as defined by the event source. | | `process.file_object.created_time_dt` | string | Optional | The time when the file was created. | | `process.file_object.creator` | string | Optional | The user that created the file. | | `process.file_object.desc` | string | Optional | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `process.file_object.fingerprints` | array | Optional | An array of digital fingerprint objects. | | `process.file_object.fingerprints.algorithm` | string | Optional | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `process.file_object.fingerprints.value` | string | Required | The digital fingerprint value. | | `process.file_object.is_system` | boolean | Optional | The indication of whether the object is part of the operating system. | | `process.file_object.mime_type` | string | Optional | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `process.file_object.modified_time_dt` | string | Optional | The time when the file was last modified. | | `process.file_object.modifier` | string | Optional | The user that last modified the file. | | `process.file_object.name` | string | Required | The name of the file. For example: svchost.exe

| | `process.file_object.owner` | string | Optional | The user that owns the file/object. | | `process.file_object.parent_folder` | string | Optional | The parent folder in which the file resides. For example: c:\windows\system32

| | `process.file_object.path` | string | Optional | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `process.file_object.product` | object | Optional | The product that created or installed the file. | | `process.file_object.product.feature` | object | Optional | The feature that reported the event. | ### Input Example `{"process":{"cmd_line":"string","created_time_dt":"string","file_object":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[{"algorithm":"string","value":"string"}],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"security_descriptor":"string","signature":{"company_name":"Example Name","created_time_dt":"string","developer_uid":"string","fingerprints":[],"issuer_name":"Example Name","serial_number":"string"},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{"cmd_line":"string","created_time_dt":"string","file_object":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string","parent_folder":"string","path":"string","product":{},"security_descriptor":"string","signature":{},"size":123,"type":"string","uid":"string","version":"string","xattributes":{}},"integrity":"string","integrity_id":123,"lineage":["string"],"loaded_modules":["string"],"name":"Example Name","parent_process":{},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"xattributes":{}},"pid":123,"sandbox":"string","terminated_time_dt":"string","tid":123,"uid":"string","user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"},"xattributes":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cmd_line` | string | The full command line used to launch an application, service, process, or job. For example: ssh user\@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used



| | `created_time_dt` | string | The time when the process was created/started. | | `file_object` | object | The process file object. | | `file_object.accessed_time_dt` | string | The time when the file was last accessed. | | `file_object.accessor` | string | The name of the user who last accessed the object. | | `file_object.attributes` | integer | The bitmask value that represents the file attributes. | | `file_object.company_name` | string | The name of the company that published the file. For example: Microsoft Corporation.

| | `file_object.confidentiality` | string | The file content confidentiality, as defined by the event source. | | `file_object.created_time_dt` | string | The time when the file was created. | | `file_object.creator` | string | The user that created the file. | | `file_object.desc` | string | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | | `file_object.fingerprints` | array | An array of digital fingerprint objects. | | `file_object.fingerprints.algorithm` | string | The hash algorithm, as reported by the event source, which was used to create the digital fingerprint. | | `file_object.fingerprints.value` | string | The digital fingerprint value. | | `file_object.is_system` | boolean | The indication of whether the object is part of the operating system. | | `file_object.mime_type` | string | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | | `file_object.modified_time_dt` | string | The time when the file was last modified. | | `file_object.modifier` | string | The user that last modified the file. | | `file_object.name` | string | The name of the file. For example: svchost.exe

| | `file_object.owner` | string | The user that owns the file/object. | | `file_object.parent_folder` | string | The parent folder in which the file resides. For example: c:\windows\system32

| | `file_object.path` | string | The full path to the file. For example: c:\windows\system32\svchost.exe.

| | `file_object.product` | object | The product that created or installed the file. | | `file_object.product.feature` | object | The feature that reported the event. | | `file_object.product.feature.name` | string | The name of the product feature. | ### Output Example `{"cmd_line":"string","created_time_dt":"string","file_object":{"accessed_time_dt":"string","accessor":"string","attributes":123,"company_name":"Example Name","confidentiality":"string","created_time_dt":"string","creator":"string","desc":"string","fingerprints":[{}],"is_system":true,"mime_type":"string","modified_time_dt":"string","modifier":"string","name":"Example Name","owner":"string"},"integrity":"string","integrity_id":123,"lineage":[],"loaded_modules":[],"name":"string","parent_process":{...` ## Product Retrieve detailed information about a specific product using its unique identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `product` | object | Required | Parameter for Product | | `product.feature` | object | Optional | The feature that reported the event. | | `product.feature.name` | string | Optional | The name of the product feature. | | `product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `product.feature.version` | string | Optional | The version of the product feature. | | `product.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `product.name` | string | Required | The name of the product. | | `product.path` | string | Optional | The installation path of the product. | | `product.uid` | string | Optional | The unique identifier of the product. | | `product.vendor_name` | string | Required | The name of the vendor of the product. | | `product.version` | string | Optional | The version of the product, as defined by the event source. For example: 2013.1.3-beta.

| ### Input Example `{"product":{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `feature` | object | The feature that reported the event. | | `feature.name` | string | The name of the product feature. | | `feature.uid` | string | The unique identifier of the product feature. | | `feature.version` | string | The version of the product feature. | | `lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `name` | string | The name of the product. | | `path` | string | The installation path of the product. | | `uid` | string | The unique identifier of the product. | | `vendor_name` | string | The name of the vendor of the product. | | `version` | string | The version of the product, as defined by the event source. For example: 2013.1.3-beta.

| ### Output Example `{"feature":{"name":"Example Name","uid":"string","version":"string"},"lang":"string","name":"string","path":"string","uid":"string","vendor_name":"string","version":"string"}` ## Remediation Initiate a remediation action within SOS Objects Pt1 using the specified parameters. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------- | | `remediation` | object | Required | Parameter for Remediation | | `remediation.desc` | string | Optional | The description of the remediation strategy. | | `remediation.kb_articles` | array | Optional | The KB article/s related to the entity | ### Input Example `{"remediation":{"desc":"string","kb_articles":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------------------- | | `desc` | string | The description of the remediation strategy. | | `kb_articles` | array | The KB article/s related to the entity | ### Output Example `{"desc":"string","kb_articles":[]}` ## Reputation Retrieve the reputation score for a specified entity from SOS Objects Pt1, requiring an input for 'reputation'. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------------------- | | `reputation` | object | Required | Parameter for Reputation | | `reputation.base_score` | number | Required | The reputation score as reported by the event source. | | `reputation.provider` | string | Optional | The provider of the reputation information. | | `reputation.score` | string | Optional | The reputation score, as defined by the event source. | ### Input Example `{"reputation":{"base_score":123,"provider":"string","score":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------------------------------------- | | `base_score` | number | The reputation score as reported by the event source. | | `provider` | string | The provider of the reputation information. | | `score` | string | The reputation score, as defined by the event source. | ### Output Example `{"base_score":123,"provider":"string","score":"string"}` ## Resource Retrieve details for a specified resource in SOS Objects Pt1 using the provided resource identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `resource` | object | Required | Parameter for Resource | | `resource.account_uid` | string | Optional | The unique identifier of the account that owns the resource (e.g. AWS Account ID). | | `resource.cloud_partition` | string | Optional | The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov). | | `resource.criticality` | string | Optional | The criticality of the resource. | | `resource.details` | string | Optional | The details pertaining to the resource. | | `resource.group_name` | string | Optional | The name of the group that the resource belongs to. | | `resource.labels` | array | Optional | The list of labels attached to an event, object, or attribute. | | `resource.name` | string | Optional | The name of the resource. | | `resource.owner` | string | Optional | The identity of the service or user account that owns the resource | | `resource.region` | string | Optional | The region of the resource. | | `resource.type` | string | Optional | The type of the resource. | | `resource.uid` | string | Optional | The unique identifier of the resource. | ### Input Example `{"resource":{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"Example Name","labels":["string"],"name":"Example Name","owner":"string","region":"string","type":"string","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | ------------------------------------------------------------------------------------------------------------------ | | `account_uid` | string | The unique identifier of the account that owns the resource (e.g. AWS Account ID). | | `cloud_partition` | string | The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov). | | `criticality` | string | The criticality of the resource. | | `details` | string | The details pertaining to the resource. | | `group_name` | string | The name of the group that the resource belongs to. | | `labels` | array | The list of labels attached to an event, object, or attribute. | | `name` | string | The name of the resource. | | `owner` | string | The identity of the service or user account that owns the resource | | `region` | string | The region of the resource. | | `type` | string | The type of the resource. | | `uid` | string | The unique identifier of the resource. | ### Output Example `{"account_uid":"string","cloud_partition":"string","criticality":"string","details":"string","group_name":"string","labels":[],"name":"string","owner":"string","region":"string","type":"string","uid":"string"}` ## Rule Create, update, or delete a rule in SOS Objects Pt1 using the specified input parameters. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------- | | `rule` | object | Required | Parameter for Rule | | `rule.category` | string | Optional | The rule category. | | `rule.desc` | string | Optional | The description of the rule that generated the event. | | `rule.name` | string | Required | The name of the rule that generated the event. | | `rule.type` | string | Optional | The rule type. | | `rule.uid` | string | Optional | The unique identifier of the rule that generated the event. | | `rule.version` | string | Optional | The rule version. For example: 1.1.

| ### Input Example `{"rule":{"category":"string","desc":"string","name":"Example Name","type":"string","uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------------------------------------------- | | `category` | string | The rule category. | | `desc` | string | The description of the rule that generated the event. | | `name` | string | The name of the rule that generated the event. | | `type` | string | The rule type. | | `uid` | string | The unique identifier of the rule that generated the event. | | `version` | string | The rule version. For example: 1.1.

| ### Output Example `{"category":"string","desc":"string","name":"string","type":"string","uid":"string","version":"string"}` ## SMTP Header Analyzes SMTP header data provided as input to extract and return relevant email information. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------- | | `smtp_header` | object | Required | Parameter for SMTP Header | | `smtp_header.name` | string | Required | The name of the header | | `smtp_header.value` | object | Required | The value of the header | ### Input Example `{"smtp_header":{"name":"Example Name","value":{}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------- | | `name` | string | The name of the header | | `value` | object | The value of the header | ### Output Example `{"name":"string","value":{}}` ## Tactic Retrieve detailed information for a specified tactic from SOS Objects Pt1 using the 'tactic' identifier. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `tactic` | object | Required | Parameter for Tactic | | `tactic.name` | string | Optional | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `tactic.uid` | string | Required | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| ### Input Example `{"tactic":{"name":"Example Name","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `name` | string | The tactic name that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| | `uid` | string | The tactic ID that is associated with the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM.


| ### Output Example `{"name":"string","uid":"string"}` ## Technique Retrieve details for a specified technique from SOS Objects Pt1 using the required 'technique' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `technique` | object | Required | Parameter for Technique | | `technique.name` | string | Optional | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: Drive-by Compromise.




| | `technique.uid` | string | Required | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: T1189.




| ### Input Example `{"technique":{"name":"Example Name","uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `name` | string | The name of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: Drive-by Compromise.




| | `uid` | string | The unique identifier of the attack technique, as defined by [https://attack.mitre.org/wiki/ATT\&CK\_Matrix](https://attack.mitre.org/wiki/ATT\&CK_Matrix)ATT\&CK MatrixTM. For example: T1189.




| ### Output Example `{"name":"string","uid":"string"}` ## User Retrieve detailed information for a specified user within the SOS Objects Pt1 service. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `user` | object | Required | Parameter for User | | `user.account_type` | string | Optional | The user account type, as defined by the event source. | | `user.account_uid` | string | Optional | The unique identifier of the account (e.g. AWS Account ID). | | `user.credential_uid` | string | Optional | The unique identifier of the user's credential. For example, AWS Access Key ID. | | `user.domain` | string | Optional | The domain where the user is defined. For example: the LDAP or Active Directory domain. | | `user.email_addr` | string | Optional | The user's email address. | | `user.groups` | array | Optional | The administrative groups to which the user belongs. | | `user.groups.desc` | string | Optional | The group description. | | `user.groups.name` | string | Required | The group name. | | `user.groups.privileges` | array | Optional | The group privileges. | | `user.groups.type` | string | Optional | The type of the group or account. | | `user.groups.uid` | string | Optional | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | | `user.name` | string | Optional | The username. For example, **janedoe1.
| | `user.org_uid` | string | Optional | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `user.session_uid` | string | Optional | The unique ID of the user session, as reported by the OS.

Examples: ******\*nix: **Aug 10 17:31:16 ip-192-168-1-1 systemd\[1]: Started Session 222 of User ubuntu.****session\_uid == 222****Windows: Logon ID: 0xd22e9734****session\_uid == 0xd22e9734



















| | `user.session_uuid` | string | Optional | The universally unique ID of the user session, as reported by the OS. For example, in Windows this is the Login GUID. | | `user.type` | string | Optional | The type of the user. For example, System, AWS IAM User, etc. | | `user.uid` | string | Optional | The unique user identifier. For example, AWS PrincipalID or Windows user SID. | | `user.uuid` | string | Optional | The universally unique identifier of the user. For example, AWS ARN or Windows user GUID. | ### Input Example `{"user":{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[{"desc":"string","name":"Example Name","privileges":["string"],"type":"string","uid":"string"}],"name":"Example Name","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `account_type` | string | The user account type, as defined by the event source. | | `account_uid` | string | The unique identifier of the account (e.g. AWS Account ID). | | `credential_uid` | string | The unique identifier of the user's credential. For example, AWS Access Key ID. | | `domain` | string | The domain where the user is defined. For example: the LDAP or Active Directory domain. | | `email_addr` | string | The user's email address. | | `groups` | array | The administrative groups to which the user belongs. | | `groups.desc` | string | The group description. | | `groups.name` | string | The group name. | | `groups.privileges` | array | The group privileges. | | `groups.type` | string | The type of the group or account. | | `groups.uid` | string | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | | `name` | string | The username. For example, **janedoe1.
| | `org_uid` | string | The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID. | | `session_uid` | string | The unique ID of the user session, as reported by the OS.

Examples: ******\*nix: **Aug 10 17:31:16 ip-192-168-1-1 systemd\[1]: Started Session 222 of User ubuntu.****session\_uid == 222****Windows: Logon ID: 0xd22e9734****session\_uid == 0xd22e9734



















| | `session_uuid` | string | The universally unique ID of the user session, as reported by the OS. For example, in Windows this is the Login GUID. | | `type` | string | The type of the user. For example, System, AWS IAM User, etc. | | `uid` | string | The unique user identifier. For example, AWS PrincipalID or Windows user SID. | | `uuid` | string | The universally unique identifier of the user. For example, AWS ARN or Windows user GUID. | ### Output Example `{"account_type":"string","account_uid":"string","credential_uid":"string","domain":"string","email_addr":"string","groups":[],"name":"string","org_uid":"string","session_uid":"string","session_uuid":"string","type":"string","uid":"string","uuid":"string"}` ## Vulnerability Details Retrieve detailed information for a specified vulnerability from SOS Objects Pt1, requiring the 'vulnerability' input. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `vulnerability` | object | Required | Parameter for Vulnerability Details | | `vulnerability.cve` | object | Required | The Common Vulnerabilities and Exposures ([https://cve.mitre.org/](https://cve.mitre.org/)CVE).
| | `vulnerability.cve.created_time_dt` | string | Optional | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `vulnerability.cve.cvss` | object | Optional | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `vulnerability.cve.cvss.base_score` | number | Required | The CVSS base score. For example: 9.1.

| | `vulnerability.cve.cvss.depth` | string | Optional | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `vulnerability.cve.cvss.metrics` | array | Optional | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `vulnerability.cve.cvss.metrics.name` | string | Required | The name of the metric. | | `vulnerability.cve.cvss.metrics.value` | object | Required | The value of the metric. | | `vulnerability.cve.cvss.overall_score` | number | Optional | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `vulnerability.cve.cvss.severity` | string | Optional | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `vulnerability.cve.cvss.vector_string` | string | Optional | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `vulnerability.cve.cvss.version` | string | Required | The CVSS version. For example: 3.1.

| | `vulnerability.cve.cwe_uid` | string | Optional | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `vulnerability.cve.cwe_url` | string | Optional | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `vulnerability.cve.modified_time_dt` | string | Optional | The Record Modified Date identifies when the CVE record was last updated. | | `vulnerability.cve.product` | object | Optional | The product where the vulnerability was discovered. | | `vulnerability.cve.product.feature` | object | Optional | The feature that reported the event. | | `vulnerability.cve.product.feature.name` | string | Optional | The name of the product feature. | | `vulnerability.cve.product.feature.uid` | string | Optional | The unique identifier of the product feature. | | `vulnerability.cve.product.feature.version` | string | Optional | The version of the product feature. | | `vulnerability.cve.product.lang` | string | Optional | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `vulnerability.cve.product.name` | string | Required | The name of the product. | | `vulnerability.cve.product.path` | string | Optional | The installation path of the product. | | `vulnerability.cve.product.uid` | string | Optional | The unique identifier of the product. | ### Input Example `{"vulnerability":{"cve":{"created_time_dt":"string","cvss":{"base_score":123,"depth":"string","metrics":[],"overall_score":123,"severity":"string","vector_string":"string","version":"string"},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"type":"string","uid":"string"},"desc":"string","kb_articles":["string"],"packages":[{"architecture":"string","epoch":123,"name":"Example Name","release":"string","version":"string"}],"references":["string"],"related_vulnerabilities":["string"],"remediation":{"desc":"string","kb_articles":["string"]},"severity":"string","title":"string","vendor_name":"Example Name"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `cve` | object | The Common Vulnerabilities and Exposures ([https://cve.mitre.org/](https://cve.mitre.org/)CVE).
| | `cve.created_time_dt` | string | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | | `cve.cvss` | object | The CVSS object details Common Vulnerability Scoring System ([https://www.first.org/cvss/](https://www.first.org/cvss/)CVSS) scores from the advisory that are related to the vulnerability.
| | `cve.cvss.base_score` | number | The CVSS base score. For example: 9.1.

| | `cve.cvss.depth` | string | The CVSS depth represents a depth of the equation used to calculate CVSS score. | | `cve.cvss.metrics` | array | The Common Vulnerability Scoring System metrics.This attribute contains information on the CVE's impact. If the CVE has been analyzed, this attribute will contain any CVSSv2 or CVSSv3 information associated with the vulnerability. For example: \{\{"Access Vector", "Network"}, \{"Access Complexity", "Low"}, ...}.

| | `cve.cvss.metrics.name` | string | The name of the metric. | | `cve.cvss.metrics.value` | object | The value of the metric. | | `cve.cvss.overall_score` | number | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.

| | `cve.cvss.severity` | string | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score.****CVSS v2.0Low (0.0 – 3.9)Medium (4.0 – 6.9)High (7.0 – 10.0)****CVSS v3.0None (0.0)Low (0.1 - 3.9)Medium (4.0 - 6.9)High (7.0 - 8.9)Critical (9.0 - 10.0)






















| | `cve.cvss.vector_string` | string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV\:L/AC\:L/PR\:L/UI\:N/S\:U/C\:H/I\:N/A\:H.

| | `cve.cvss.version` | string | The CVSS version. For example: 3.1.

| | `cve.cwe_uid` | string | The [https://cwe.mitre.org/](https://cwe.mitre.org/)Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.


| | `cve.cwe_url` | string | Common Weakness Enumiration (CWE) definition URL. For example: [https://cwe.mitre.org/data/definitions/787.html](https://cwe.mitre.org/data/definitions/787.html).

| | `cve.modified_time_dt` | string | The Record Modified Date identifies when the CVE record was last updated. | | `cve.product` | object | The product where the vulnerability was discovered. | | `cve.product.feature` | object | The feature that reported the event. | | `cve.product.feature.name` | string | The name of the product feature. | | `cve.product.feature.uid` | string | The unique identifier of the product feature. | | `cve.product.feature.version` | string | The version of the product feature. | | `cve.product.lang` | string | The two letter lower case language codes, as defined by [https://en.wikipedia.org/wiki/ISO\_639-1](https://en.wikipedia.org/wiki/ISO_639-1)ISO 639-1. For example: en (English), de (German), or fr (French).






| | `cve.product.name` | string | The name of the product. | | `cve.product.path` | string | The installation path of the product. | | `cve.product.uid` | string | The unique identifier of the product. | | `cve.product.vendor_name` | string | The name of the vendor of the product. | ### Output Example `{"cve":{"created_time_dt":"string","cvss":{"base_score":123,"depth":"string","metrics":[],"overall_score":123,"severity":"string","vector_string":"string","version":"string"},"cwe_uid":"string","cwe_url":"string","modified_time_dt":"string","product":{"feature":{},"lang":"string","name":"Example Name","path":"string","uid":"string","vendor_name":"Example Name","version":"string"},"type":"string","uid":"string"},"desc":"string","kb_articles":[],"packages":[],"references":[],"related_vulnerabiliti...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |