Symantec Dlp
Symantec DLP is a data protection solution that helps organizations prevent data breaches and ensure compliance.
Symantec Data Loss Prevention (DLP) is a comprehensive solution designed to protect sensitive data from unauthorized access and breaches. The Symantec DLP connector for Swimlane Turbine enables seamless integration with Symantec's robust data protection capabilities, allowing users to automate incident response and policy management. By leveraging this integration, Swimlane Turbine users can efficiently manage incidents, retrieve detailed incident data, and update policies, enhancing their security operations and reducing response times.
Limitations
None to date.
Supported Versions
This connector uses version 16.1 Symantec DLP.
Additional Docs
Configuration
Prerequisites
Before you can use the Symantec DLP connector for Turbine, you'll need access to the Symantec DLP API. This requires the following:
- HTTP Basic authentication using the following parameters:
- URL: The endpoint URL for accessing the Symantec DLP API.
- Username: Your Symantec DLP account username.
- Password: The password associated with your Symantec DLP account.
Authentication Methods
Basic Authentication
- URL: The base endpoint for the Symantec DLP API.
- Username: Your Symantec DLP account username.
- Password: Your Symantec DLP account password.
Capabilities
This Symantec DLP Connector provides the following capabilities:
- Get All Component Matches
- Get Component Data
- Get Editable Incident Details
- Get Form Image
- Get Incident Components
- Get Incident Correlations
- Get Incident History
- Get Incident Message Body
- Get Incident Original Message
- Get Policy Matches
- Get Static Incident Details
- List Incidents in CSV
- List Incidents in JSON
- List Summary of Incidents in CSV
- List Summary of Incidents in JSON ... and so on
Get All Component Matches
- Retrieves all the matches of the components for an incident (Click here).
Get Component Data
- Retrieves the data of a specified incident component based on the component ID (Click here).
Get Editable Incident Details
- Retrieves editable attributes of the specified incident. The API only returns the attributes that the user has permissions to read (Click here).
Get Form Image
- Retrieves the form image from the database or an external disk based on the message ID and violation ID (Click here).
Get Incident Components
- Retrieves a list of all incident components. The list contains the ID, name and MIME-type of the components (Click here).
Get Incident Correlations
- Retrieves the correlations of the specified incident (Click here).
Get Incident History
- Retrieves the history and notes of the specified incident (Click here).
Get Incident Message Body
- Retrieves the message body of the specified incident. The message body is available for download if required permissions are satisfied (Click here).
Get Incident Original Message
- Retrieves the original message of the specified incident. The original message is available for download if required permissions are satisfied (Click here).
Get Policy Matches
- Retrieves information of the other violated policies for the specified incident (Click here).
Get Static Incident Details
- Retrieves static attributes of the specified incident. Only returns the attributes that the user has permissions to read (Click here).
List Incidents in CSV
- Retrieves multiple incidents in CSV format using a single API call Click here.
List Incidents in JSON
- Generates a list of JSON-formatted incidents based on specified criteria Click here.
List Summary of Incidents in CSV
- Retrieves a summary of incidents in CSV format using a single API call Click here.
List Summary of Incidents in JSON
- Retrieves a summary of incidents using a single API call Click here.
Update a Policy
- Enables or disables policies specified by the policy ID (Click here).
Configurations
Symantec DLP HTTP Basic Authentication
Authenticates using username and password.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
username | Username | string | Required |
password | Password | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Get All Component Matches
Retrieve all component matches for a specified incident ID in Symantec DLP.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/components/matches
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"messageComponentId":42,"messageComponentName":"Body","mimeType":"text/plain","originalSize":200,"messageComponentTypeName":"Body","isComponentAvailable":false},{"messageComponentId":43,"messageComponentName":"SecretFile.doc","mimeType":"application/msword","originalSize":134753,"messageComponentTypeName":"Attachment","isComponentAvailable":true}]}
Get Component Data
Retrieve incident component data from Symantec DLP using a specific component ID provided in the path parameters.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/components/{{componentId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
path_parameters.componentId | number | Required | The message component ID. |
Input Example
{"path_parameters":{"id":1,"componentId":2}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"file":{"file":"string","file_name":"Example Name"}}
Get Editable Incident Details
Retrieve editable attributes of a specified incident in Symantec DLP, including user permissions verification. Requires the incident ID as a path parameter.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/history
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
incidentId | number | Unique identifier |
infoMap | object | Output field: infoMap |
infoMap.preventOrProtectStatusId | number | Unique identifier |
infoMap.incidentStatusName | string | Unique identifier |
infoMap.isHidingNotAllowed | boolean | Unique identifier |
infoMap.severityId | number | Unique identifier |
infoMap.incidentStatusId | number | Unique identifier |
infoMap.isHidden | boolean | Unique identifier |
customAttributeGroups | array | Output field: customAttributeGroups |
customAttributeGroups.name | string | Name of the resource |
customAttributeGroups.customAttributes | array | Output field: customAttributeGroups.customAttributes |
customAttributeGroups.customAttributes.name | string | Name of the resource |
customAttributeGroups.customAttributes.index | number | Output field: customAttributeGroups.customAttributes.index |
customAttributeGroups.customAttributes.displayOrder | number | Output field: customAttributeGroups.customAttributes.displayOrder |
customAttributeGroups.customAttributes.email | boolean | Output field: customAttributeGroups.customAttributes.email |
customAttributeGroups.nameInternationalized | boolean | Name of the resource |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"incidentId":1,"infoMap":{"preventOrProtectStatusId":0,"incidentStatusName":"incident.status.New","isHidingNotAllowed":false,"severityId":1,"incidentStatusId":1,"isHidden":false},"customAttributeGroups":[{}]}}
Get Form Image
Retrieve the form image for a specified message and violation ID from Symantec DLP using path parameters: id, messageId, and violationId.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/message/{{messageId}}/violation/{{violationId}}/image
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
path_parameters.messageId | number | Required | The message ID. |
path_parameters.violationId | number | Required | The violation condition ID. |
Input Example
{"path_parameters":{"id":1,"messageId":2,"violationId":3}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"file":{"file":"string","file_name":"Example Name"}}
Get Incident Components
Retrieve all components of a Symantec DLP incident, including ID, name, and MIME-type, using the specified incident ID.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/components
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"messageComponentId":42,"messageComponentName":"Body","mimeType":"text/plain","originalSize":200,"messageComponentTypeName":"Body","isComponentAvailable":false},{"messageComponentId":43,"messageComponentName":"SecretFile.doc","mimeType":"application/msword","originalSize":134753,"messageComponentTypeName":"Attachment","isComponentAvailable":true}]}
Get Incident Correlations
Retrieve correlations for a specified incident in Symantec DLP using the unique identifier provided.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/correlations
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"variable":"incident.sender","label":"Sender","correlationValues":[{"value":"[email protected]","countSevenDays":0,"countThirtyDays":0,"countAllDays":24}]},{"variable":"incident.recipient","label":"Recipient","correlationValues":[{"value":"[email protected]","countSevenDays":0,"countThirtyDays":0,"countAllDays":24}]},{"variable":"incident.message.subject","label":"Subject","correlationValues":[{"value":"secret","countSevenDays":...
Get Incident History
Retrieve the history and notes for a specified incident in Symantec DLP using the provided incident ID.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/history
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":[{"incidentHistoryDate":"2022-08-26T15:17:37.369","dlpUserName":"Administrator","incidentHistoryAction":"SET_STATUS","incidentHistoryDetail":"New","policyGroupId":1,"detectionServerName":"Vontu Monitor One","incidentId":1,"messageSource":"NETWORK","messageDate":"2017-07-27T16:08:09","incidentHistoryActionString":"Status Changed"},{"incidentHistoryDate":"2022-08-26T15:17:23.19","dlpUserName":"Administrator","incidentHistoryAction"...
Get Incident Message Body
Retrieve the message body of a specified incident from Symantec DLP using an 'id' path parameter.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/messageBody
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"file":{"file":"string","file_name":"Example Name"}}
Get Incident Original Message
Retrieve the original message of a specified incident in Symantec DLP using the incident ID.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/originalMessage
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file | string | Output field: file.file |
file.file_name | string | Name of the resource |
Output Example
{"file":{"file":"string","file_name":"Example Name"}}
Get Policy Matches
Retrieve detailed policy violation information for a given incident ID in Symantec DLP.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/policymatches
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
violatedRules | array | Output field: violatedRules |
violatedRules.ruleName | string | Name of the resource |
violatedRules.ruleTypeI18nKey | string | Type of the resource |
violatedRules.matches | number | Output field: violatedRules.matches |
policyName | string | Name of the resource |
otherPoliciesViolated | array | Output field: otherPoliciesViolated |
otherPoliciesViolated.POLICYID | number | Unique identifier |
otherPoliciesViolated.INCIDENTID | number | Unique identifier |
otherPoliciesViolated.POLICYNAME | string | Name of the resource |
otherPoliciesViolated.PREVENTORPROTECTSTATUSID | number | Unique identifier |
matches | number | Output field: matches |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"violatedRules":[{}],"policyName":"symantec","otherPoliciesViolated":[{"POLICYID":28476,"INCIDENTID":2147525031,"POLICYNAME":"BlockBATNewDLPKeywords","PREVENTORPROTECTSTATUSID":0},{"POLICYID":28314,"INCIDENTID":2147525029,"POLICYNAME":"EP-Block","PREVENTORPROTECTSTATUSID":0},{"POLICYID":28355,"INCIDENTID":2147525030,"POLICYNAME":"Qurantine-edar-policy","PREVENTORPROTECTSTATUSID":0}],"matches":3}}
Get Static Incident Details
Retrieve static attributes for a specified incident in Symantec DLP, ensuring compliance with user permissions. Requires the incident ID as a path parameter.
Endpoint
- URL: /ProtectManager/webservices/v2/incidents/{{id}}/staticAttributes
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | number | Required | The incident ID. |
Input Example
{"path_parameters":{"id":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
incidentId | number | Unique identifier |
infoMap | object | Output field: infoMap |
infoMap.attachmentInfo | array | Output field: infoMap.attachmentInfo |
infoMap.attachmentInfo.messageComponentName | string | Name of the resource |
infoMap.attachmentInfo.messageComponentId | number | Unique identifier |
infoMap.attachmentInfo.wasCracked | boolean | Output field: infoMap.attachmentInfo.wasCracked |
infoMap.attachmentInfo.documentFormat | string | Output field: infoMap.attachmentInfo.documentFormat |
infoMap.attachmentInfo.messageComponentType | number | Type of the resource |
infoMap.attachmentInfo.originalSize | string | Output field: infoMap.attachmentInfo.originalSize |
infoMap.attachmentInfo.attachmentSize | string | Output field: infoMap.attachmentInfo.attachmentSize |
infoMap.messageOriginatorID | number | Unique identifier |
infoMap.fileCreateDate | string | Date value |
infoMap.uniqueMessageId | string | Unique identifier |
infoMap.fileAccessDate | string | Date value |
infoMap.messageType | string | Type of the resource |
infoMap.endpointFilePath | string | Output field: infoMap.endpointFilePath |
infoMap.endpointApplicationPath | string | Output field: infoMap.endpointApplicationPath |
infoMap.senderIPAddress | string | Output field: infoMap.senderIPAddress |
infoMap.endpointVolumeName | string | Name of the resource |
infoMap.fileCreatedBy | string | Output field: infoMap.fileCreatedBy |
infoMap.domainUserName | string | Name of the resource |
infoMap.policyId | number | Unique identifier |
infoMap.policyName | string | Name of the resource |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"incidentId":1,"infoMap":{"attachmentInfo":[],"messageOriginatorID":1,"fileCreateDate":"2019-06-26T17:33:06.71","uniqueMessageId":"F1472CC7-CF59-405C-9F12-CE428B112978","fileAccessDate":"2019-06-26T00:00:00","messageType":"ENDPOINTUSB","endpointFilePath":"E:\\ftpMe.txt","endpointApplicationPath":"\\Device\\HarddiskVolume1\\WINDOWS\\explorer.exe","senderIPAddress":"10.66.221.73","endpointVolumeName":"\\Device\\Harddisk1\\DP(1)0-0...
List Incidents in CSV
Retrieve multiple incidents in CSV format using a single API call in Symantec DLP. Requires JSON body with 'select' parameter.
Endpoint
- URL: /ProtectManager/webservices/v2incidents/csv
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
select | array | Optional | Parameter for List Incidents in CSV |
select.actionUser | string | Optional | For any incident type, lists the user or users who performed an action on an incident.. |
filter | object | Optional | Parameter for List Incidents in CSV |
filter.booleanOperator | string | Optional | The boolean operator to use for the filter. |
filter.filters | array | Optional | Parameter for List Incidents in CSV |
filter.filters.operandOne | object | Optional | Parameter for List Incidents in CSV |
filter.filters.operandOne.name | string | Optional | Specifies the type of incident, e.g. "NETWORK", "DISCOVER", "ENDPOINT". |
filter.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.operator | string | Optional | Specifies the operator to use for the filter. |
filter.filters.operandTwoValues | array | Optional | Specifies the values to use for the filter. |
filter.filters.booleanOperator | string | Optional | Parameter for List Incidents in CSV |
filter.filters.filters | array | Optional | Parameter for List Incidents in CSV |
filter.filters.filters.operandOne | object | Optional | Specifies the type of incident, e.g. "NETWORK", "DISCOVER", "ENDPOINT". |
filter.filters.filters.operandOne.name | string | Optional | Specify the field name. |
filter.filters.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.filters.operator | string | Optional | Specifies the operator to use for the filter. |
filter.filters.filters.operandTwoValues | array | Optional | Specifies the values to use for the filter. |
filter.filterType | string | Optional | Specifies the type of filter to use. |
orderBy | array | Optional | Parameter for List Incidents in CSV |
orderBy.field | object | Required | For an IncidentQueryRequest, any SelectField is allowed. For an IncidentSummaryQueryRequest, only the outer summary field or SummarySortableFields are allowed. |
orderBy.field.name | string | Optional | Specify the field name. |
orderBy.order | string | Optional | Define the sorting order for the field. Use ASC for ascending or DESC for descending. |
page | object | Optional | Parameter for List Incidents in CSV |
page.type | string | Required | Specify the pagination type. |
page.pageNumber | number | Required | Specify the page number. |
Input Example
{"json_body":{"select":[{"name":"incidentId"},{"name":"policyGroupId"}],"filter":{"booleanOperator":"AND","filters":[{"operandOne":{"name":"messageSource"},"filterType":"string","operator":"EQ","operandTwoValues":["NETWORK"]},{"booleanOperator":"OR","filters":[{"operandOne":{"name":"messageTypeId"},"filterType":"long","operator":"NOT_IN","operandTwoValues":[48,49]},{"operandOne":{"name":"messageTypeId"},"filterType":"long","operator":"IS_NULL"}],"filterType":"booleanLogic"}],"filterType":"booleanLogic"},"orderBy":[{"field":{"name":"messageDate"},"order":"DESC"}],"page":{"type":"offset","pageNumber":1,"pageSize":5}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file_name | string | Name of the resource |
file.file | string | Output field: file.file |
Output Example
{"file":{"file_name":"Example Name","file":"string"}}
List Incidents in JSON
Generate a list of JSON-formatted incidents in Symantec DLP based on specified criteria, requiring the 'select' parameter in the JSON body.
Endpoint
- URL: ProtectManager/webservices/v2/incidents
- Method: ProtectManager/webservices/v2/incidents
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
select | array | Optional | Parameter for List Incidents in JSON |
select.actionUser | string | Optional | For any incident type, lists the user or users who performed an action on an incident.. |
filter | object | Optional | Parameter for List Incidents in JSON |
filter.booleanOperator | string | Optional | The boolean operator to use for the filter. |
filter.filters | array | Optional | Parameter for List Incidents in JSON |
filter.filters.operandOne | object | Optional | Parameter for List Incidents in JSON |
filter.filters.operandOne.name | string | Optional | Specifies the type of incident, e.g. "NETWORK", "DISCOVER", "ENDPOINT". |
filter.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.operator | string | Optional | Specifies the operator to use for the filter. |
filter.filters.operandTwoValues | array | Optional | Specifies the values to use for the filter. |
filter.filters.booleanOperator | string | Optional | Parameter for List Incidents in JSON |
filter.filters.filters | array | Optional | Parameter for List Incidents in JSON |
filter.filters.filters.operandOne | object | Optional | Specifies the type of incident, e.g. "NETWORK", "DISCOVER", "ENDPOINT". |
filter.filters.filters.operandOne.name | string | Optional | Specify the field name. |
filter.filters.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.filters.operator | string | Optional | Specifies the operator to use for the filter. |
filter.filters.filters.operandTwoValues | array | Optional | Specifies the values to use for the filter. |
filter.filterType | string | Optional | Specifies the type of filter to use. |
orderBy | array | Optional | Parameter for List Incidents in JSON |
orderBy.field | object | Required | For an IncidentQueryRequest, any SelectField is allowed. For an IncidentSummaryQueryRequest, only the outer summary field or SummarySortableFields are allowed. |
orderBy.field.name | string | Optional | Specify the field name. |
orderBy.order | string | Optional | Define the sorting order for the field. Use ASC for ascending or DESC for descending. |
page | object | Optional | Parameter for List Incidents in JSON |
page.type | string | Required | Specify the pagination type. |
page.pageNumber | number | Required | Specify the page number. |
Input Example
{"json_body":{"select":[{"name":"incidentId"},{"name":"policyGroupId"}],"filter":{"booleanOperator":"AND","filters":[{"operandOne":{"name":"messageSource"},"filterType":"string","operator":"EQ","operandTwoValues":["NETWORK"]},{"booleanOperator":"OR","filters":[{"operandOne":{"name":"messageTypeId"},"filterType":"long","operator":"NOT_IN","operandTwoValues":[48,49]},{"operandOne":{"name":"messageTypeId"},"filterType":"long","operator":"IS_NULL"}],"filterType":"booleanLogic"}],"filterType":"booleanLogic"},"orderBy":[{"field":{"name":"messageDate"},"order":"DESC"}],"page":{"type":"offset","pageNumber":1,"pageSize":5}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
incidents | array | Unique identifier |
incidents.messageSubject | string | Unique identifier |
incidents.policyName | string | Unique identifier |
incidents.policyGroupId | number | Unique identifier |
incidents.messageId | number | Unique identifier |
incidents.matchCount | number | Unique identifier |
incidents.preventOrProtectStatusId | number | Unique identifier |
incidents.hasAttachment | string | Unique identifier |
incidents.incidentStatusName | string | Unique identifier |
incidents.messageType | string | Unique identifier |
incidents.messageTypeId | number | Unique identifier |
incidents.messageDate | string | Unique identifier |
incidents.incidentId | number | Unique identifier |
incidents.severityId | number | Unique identifier |
incidents.networkSenderIdentifier | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"incidents":[{},{}]}}
List Summary of Incidents in CSV
Retrieve a summary of incidents in CSV format from Symantec DLP using a single API call. Requires 'groupBy' parameter in the JSON body.
Endpoint
- URL: ProtectManager/webservices/v2/incidents/summary/csv
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filter | object | Optional | Parameter for List Summary of Incidents in CSV |
filter.filterType | string | Optional | Specifies the type of filter to use. |
filter.booleanOperator | string | Optional | The boolean operator (AND, OR) to apply to the embedded filters. |
filter.filters | array | Optional | The filters to apply to the data. |
filter.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.operandOne | object | Optional | Specifies the field to filter by. |
filter.filters.operandOne.name | object | Optional | Specify the field name. |
filter.filters.operandOne.name.messageTypeId | number | Optional | The ID of the message type. |
filter.filters.operator | string | Optional | The operator to use for the filter. |
filter.filters.operandTwoValues | array | Optional | The values to use for the filter. |
filter.filters.booleanOperator | string | Optional | The boolean operator (AND, OR) to apply to the embedded filters. |
filter.filters.filters | array | Optional | The filters to apply to the data. |
filter.filters.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.filters.operandOne | object | Optional | Specifies the field to filter by. |
filter.filters.filters.operandOne.name | string | Optional | Specify the field name. |
filter.filters.filters.operator | string | Optional | The operator to use for the filter. |
filter.filters.filters.operandTwoValues | array | Optional | The values to use for the filter. |
orderBy | array | Optional | Parameter for List Summary of Incidents in CSV |
orderBy.field | object | Required | For an IncidentQueryRequest, any SelectField is allowed. For an IncidentSummaryQueryRequest, only the outer summary field or SummarySortableFields are allowed. |
orderBy.field.name | string | Optional | Specify the field name. |
orderBy.order | string | Optional | Define the sorting order for the field. Use ASC for ascending or DESC for descending. |
groupBy | object | Optional | Parameter for List Summary of Incidents in CSV |
groupBy.outerSummary | object | Required | Parameter for List Summary of Incidents in CSV |
groupBy.outerSummary.categories | string | Optional | For Network incidents, the categories of the URL, as classified by ProxySG and ASG, to determine riskiness of the destination URL. |
groupBy.innerSummary | object | Optional | Parameter for List Summary of Incidents in CSV |
Input Example
{"json_body":{"filter":{"filterType":"booleanLogic","booleanOperator":"AND","filters":[{"filterType":"long","operandOne":{"name":{"messageTypeId":48}},"operator":"IN","operandTwoValues":[48,49]},{"filterType":"booleanLogic","booleanOperator":"AND","filters":[{"filterType":"string","operandOne":{"name":"restCommonDatatype"},"operator":"EQ","operandTwoValues":["DAR"]}]}]},"orderBy":[{"field":{"name":"restCommonApplication"},"order":"ASC"}],"groupBy":{"outerSummary":{"categories":"restCommonApplication"},"innerSummary":{"categories":"incidentStatusId"}},"page":{"type":"offset","pageNumber":1,"pageSize":100}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
file | object | Output field: file |
file.file_name | string | Name of the resource |
file.file | string | Output field: file.file |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","file":{"file_name":"list_summary_of_incidents_in_csv_output.csv","file":"data:text/csv;base64,..."}}
List Summary of Incidents in JSON
Retrieve a summary of incidents in Symantec DLP using a single API call, requiring the groupBy parameter in JSON format.
Endpoint
- URL: /ProtectManager/webservices/v2incidents/summary
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filter | object | Optional | Parameter for List Summary of Incidents in JSON |
filter.filterType | string | Optional | Specifies the type of filter to use. |
filter.booleanOperator | string | Optional | The boolean operator (AND, OR) to apply to the embedded filters. |
filter.filters | array | Optional | The filters to apply to the data. |
filter.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.operandOne | object | Optional | Specifies the field to filter by. |
filter.filters.operandOne.name | object | Optional | Specify the field name. |
filter.filters.operandOne.name.messageTypeId | number | Optional | The ID of the message type. |
filter.filters.operator | string | Optional | The operator to use for the filter. |
filter.filters.operandTwoValues | array | Optional | The values to use for the filter. |
filter.filters.booleanOperator | string | Optional | The boolean operator (AND, OR) to apply to the embedded filters. |
filter.filters.filters | array | Optional | The filters to apply to the data. |
filter.filters.filters.filterType | string | Optional | Specifies the type of filter to use. |
filter.filters.filters.operandOne | object | Optional | Specifies the field to filter by. |
filter.filters.filters.operandOne.name | string | Optional | Specify the field name. |
filter.filters.filters.operator | string | Optional | The operator to use for the filter. |
filter.filters.filters.operandTwoValues | array | Optional | The values to use for the filter. |
orderBy | array | Optional | Parameter for List Summary of Incidents in JSON |
orderBy.field | object | Required | For an IncidentQueryRequest, any SelectField is allowed. For an IncidentSummaryQueryRequest, only the outer summary field or SummarySortableFields are allowed. |
orderBy.field.name | string | Optional | Specify the field name. |
orderBy.order | string | Optional | Define the sorting order for the field. Use ASC for ascending or DESC for descending. |
groupBy | object | Optional | Parameter for List Summary of Incidents in JSON |
groupBy.outerSummary | object | Required | Parameter for List Summary of Incidents in JSON |
groupBy.outerSummary.categories | string | Optional | For Network incidents, the categories of the URL, as classified by ProxySG and ASG, to determine riskiness of the destination URL. |
groupBy.innerSummary | object | Optional | Parameter for List Summary of Incidents in JSON |
Input Example
{"json_body":{"filter":{"filterType":"booleanLogic","booleanOperator":"AND","filters":[{"filterType":"long","operandOne":{"name":{"messageTypeId":48}},"operator":"IN","operandTwoValues":[48,49]},{"filterType":"booleanLogic","booleanOperator":"AND","filters":[{"filterType":"string","operandOne":{"name":"restCommonDatatype"},"operator":"EQ","operandTwoValues":["DAR"]}]}]},"orderBy":[{"field":{"name":"restCommonApplication"},"order":"ASC"}],"groupBy":{"outerSummary":{"categories":"restCommonApplication"},"innerSummary":{"categories":"incidentStatusId"}},"page":{"type":"offset","pageNumber":1,"pageSize":100}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
summary | object | Output field: summary |
summary.total | number | Output field: summary.total |
summary.high | number | Output field: summary.high |
summary.outerSummary | array | Output field: summary.outerSummary |
summary.outerSummary.summary | string | Output field: summary.outerSummary.summary |
summary.outerSummary.total | number | Output field: summary.outerSummary.total |
summary.outerSummary.high | number | Output field: summary.outerSummary.high |
summary.outerSummary.low | number | Output field: summary.outerSummary.low |
summary.outerSummary.innerSummary | array | Output field: summary.outerSummary.innerSummary |
summary.outerSummary.innerSummary.summary | string | Output field: summary.outerSummary.innerSummary.summary |
summary.outerSummary.innerSummary.total | number | Output field: summary.outerSummary.innerSummary.total |
summary.outerSummary.innerSummary.high | number | Output field: summary.outerSummary.innerSummary.high |
summary.outerSummary.innerSummary.low | number | Output field: summary.outerSummary.innerSummary.low |
summary.outerSummary.innerSummary.label | string | Output field: summary.outerSummary.innerSummary.label |
summary.outerSummary.innerSummary.med | number | Output field: summary.outerSummary.innerSummary.med |
summary.outerSummary.innerSummary.matches | number | Output field: summary.outerSummary.innerSummary.matches |
summary.outerSummary.innerSummary.value | string | Value for the parameter |
summary.outerSummary.innerSummary.info | number | Output field: summary.outerSummary.innerSummary.info |
summary.outerSummary.label | string | Output field: summary.outerSummary.label |
summary.outerSummary.rowCount | number | Count value |
summary.outerSummary.value | string | Value for the parameter |
summary.outerSummary.med | number | Output field: summary.outerSummary.med |
summary.outerSummary.matches | number | Output field: summary.outerSummary.matches |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"summary":{"total":119,"high":119,"outerSummary":[],"low":0,"rowCount":3,"med":0,"matches":210,"info":0}}}
Update a Policy
Enable or disable a specific Symantec DLP policy using the provided policy ID and enable status.
Endpoint
- URL: /ProtectManager/webservices/v2/policy/{{policyId}}
- Method: PUT
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.policyId | number | Required | The Policy ID. |
enable | boolean | Optional | Set true when you want to activate the policy, set false when you want to deactivate the policy. |
Input Example
{"json_body":{"enable":true},"path_parameters":{"policyId":1}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":"Policy is updated successfully."}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |