--- title: Symantec Endpoint Security slug: connectors/symantec-endpoint-security docTags: createdAt: 2026-06-09T16:30:24.277Z --- The Swimlane Symantec Endpoint Security connector integrates Symantec Endpoint Security with Swimlane to command devices. ## Prerequisites To obtain your `client_id` and `client_secret`, required by the asset, log in to [the Symantec Securitycloud website](https://sep.securitycloud.symantec.com/v2/home/dashboard). Then, under the Integration tab in the main menu, click Client Applications. ## Capabilities This connector provides the following capabilities: - Add BlackList - Apply Policy - Delete BlackList - Get Devices Information - Get File Finger Print List By Name - Get File Finger Print List - Get Policies - Get Policy by ID - Get Policy Versions - Get Policy Target Rules - Get Device Group Policies - Update BlackList - Make a Custom Scan - Make a Full Scan - Make a Quick Scan *... and so on* ## Action Setup Some actions need one or more `Device ID` to run. The action `Get Devices` helps to get additional information about your devices. For example, you can use the `name` input to get information about that specific device. ### Relative time format The following actions accept relative time formats for `Start Date` and `End Date` inputs: - Get Incidents - Get Incidents Events You can use any standard datetime format supported by Pendulum, or a relative datetime. For the current time: ```javascript now ``` Any other time: ```javascript (+/-)(integer) (milliseconds|seconds|minutes|days|weeks|months|years) ``` For example: ```javascript now -1 months +3 days -123 seconds ``` ### Queries The following actions use queries to filter output data: - Get Incidents - Get Commands You can use the query input to filter out the results. When creating a search query string, consider the following: - You can search supported fields by specifying the field name followed by a colon ":" and then the term you are looking for. - You can also escape special characters that are part of the query syntax. To escape a special character use \ before the character. Here is the current list of special characters: + - && || ! ( ) \{ } \[ ] ^ " \~ \* ? \\ - The date value should follow the ISO 8601 date stamp standard format: (yyyy-MM-dd’T’HH\:mm\:ss.SSSZ) - Supported Boolean operators for complex query are: AND OR + - NOT **Note:** Boolean operators must be ALL CAPS. - Multiple terms can be combined together with Boolean operators to form a more complex query in the query clause. - Use parentheses to group clauses to form sub-queries. - Defaults to all incidents updated between the start\_time and end\_time specified in the query. - The maximum length of the query string is 1024 characters. - Supported fields for query include: state\_id, incident\_uid, created, modified, reference\_incident\_uid, priority\_id, severity\_id, remediation, suspected\_breach, detection\_type, conclusion,resolution\_id ## Notes - [Symantec Securitycloud website](https://sep.securitycloud.symantec.com/v2/home/dashboard) - [Symantec Endpoint Security API documentation](https://apidocs.securitycloud.symantec.com/#/doc?id=edr_incidents) - Product version tested against: v1 # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ---------------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | custom\_client\_id | Client ID | string | Required | | custom\_client\_secret | Client Secret | string | Required | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add BlackList Adds a blacklist as a file fingerprint list to Symantec Endpoint Protection Manager. A system administrator account is required for this action. ### Endpoint - **URL:** `api/v1/policy-objects/fingerprints` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `name` | string | Optional | Name of the resource | | `domainId` | string | Optional | Unique identifier | | `hashType` | string | Optional | Type of the resource | | `description` | string | Optional | Parameter for Add BlackList | | `data` | array | Optional | Response data | ### Input Example `{"name":"Example Name","domainId":"string","hashType":"string","description":"string","data":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Apply Policy This API lets you apply a policy to device groups. ### Endpoint - **URL:** `/v1/policies/{{policy_uid}}/versions/{{version}}/device-groups` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------------------- | | `path_parameters.policy_uid` | string | Required | Parameters for the Apply Policy action | | `path_parameters.version` | string | Required | Parameters for the Apply Policy action | | `target_rules` | array | Optional | Parameter for Apply Policy | | `override` | boolean | Optional | Unique identifier | | `device_group_ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"target_rules":["quarantine"],"override":true,"device_group_ids":["Wa1jpJDFRMSFBVoHSbuK7g"]},"path_parameters":{"policy_uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{},"reason":"OK","json_body":{}}` ## Cancel Command This API lets you cancel the endpoint search command. ### Endpoint - **URL:** `v1/commands/endpoint-search/{{command_id}}/cancel` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.command_id` | string | Required | Parameters for the Cancel Command action | ### Input Example `{"path_parameters":{"command_id":"EDRC-722EB5FA-9CE7-4770-9948-A18F92F62FAD"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":404,"response_headers":{"Date":"Thu, 22 Dec 2022 19:23:52 GMT","Content-Type":"application/json","Content-Length":"99","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"23","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"Search history object not found for command:EDRC-722EB5FA-9CE7-4770-9948-A18F92F..."}}` ## Custom Scan Runs a custom scan ### Endpoint - **URL:** `v1/commands/scans/custom` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------- | | `device_ids` | array | Optional | Unique identifier | | `org_unit_ids` | array | Optional | Unique identifier | | `is_recursive` | boolean | Optional | Parameter for Custom Scan | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Delete BlackList Deletes an existing blacklist, and removes it from a group to which it applies. A system administrator account is required for this action. ### Endpoint - **URL:** `api/v1/policy-objects/fingerprints/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Delete BlackList action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Delete Command This API lets you delete the endpoint search command. ### Endpoint - **URL:** `v1/commands/endpoint-search/{{command_id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.command_id` | string | Required | Parameters for the Delete Command action | ### Input Example `{"path_parameters":{"command_id":"EDRC-722EB5FA-9CE7-4770-9948-A18F92F62FAD"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 19:26:36 GMT","Content-Length":"0","Connection":"keep-alive","Server":"envoy","cache-control":"no-cache, no-store, max-age=0, must-revalidate","pragma":"no-cache","expires":"0","x-xss-protection":"1; mode=block","x-frame-options":"DENY","x-content-type-options":"nosniff","x-envoy-upstream-service-time":"12","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","response_text":""}` ## Full Dump Command This API lets you send the full dump command on the device. ### Endpoint - **URL:** `v1/commands/endpoint-search/fulldump` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------- | | `device_id` | string | Optional | Unique identifier | | `description` | string | Optional | Parameter for Full Dump Command | ### Input Example `{"json_body":{"device_id":"4u_t38vBRrCg8LH2SoxHwg","description":"test"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.command_type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 23 Dec 2022 15:26:43 GMT","Content-Type":"application/json","Content-Length":"206","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"1052","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Full Scan Runs a full scan ### Endpoint - **URL:** `v1/commands/scans/full` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------- | | `device_ids` | array | Optional | Unique identifier | | `org_unit_ids` | array | Optional | Unique identifier | | `is_recursive` | boolean | Optional | Parameter for Full Scan | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Get Command by ID This API lets you get the details of endpoint search command. ### Endpoint - **URL:** `v1/commands/endpoint-search/{{command_id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.command_id` | string | Required | Parameters for the Get Command by ID action | ### Input Example `{"path_parameters":{"command_id":"EDRC-6648F9AF-DB51-4D86-8FF4-4C66C901A879"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `command_id` | string | Unique identifier | | `user_name` | string | Name of the resource | | `create_time` | string | Time value | | `command_status` | string | Status value | | `command_type` | string | Type of the resource | | `total_endpoints` | number | Output field: total\_endpoints | | `completed_endpoints` | number | Output field: completed\_endpoints | | `endpoint_status_count` | object | Status value | | `endpoint_status_count.FOUND` | number | Status value | ### Output Example `{"status_code":404,"response_headers":{"Date":"Fri, 23 Dec 2022 15:14:44 GMT","Content-Type":"application/json","Content-Length":"99","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"19","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"name":"Public API - Full Dump","command_id":"EDRC-6648F9AF-DB51-4D86-8FF4-4C66C901A879","user_name":"edrCust-gcp-dev861871","create_time":"2021-12-28T10:15:16.507Z","co...` ## Get Commands This API lets you get the list of endpoint search commands. ### Endpoint - **URL:** `v1/commands/endpoint-search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------- | | `query` | string | Optional | Parameter for Get Commands | ### Input Example `{"json_body":{"query":"command_status: ERROR"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `commands` | array | Output field: commands | | `commands.file_name` | string | Name of the resource | | `commands.file` | string | Output field: commands.file | | `total` | number | Output field: total | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 18:56:21 GMT","Content-Type":"application/json","Content-Length":"25","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"18","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"commands":[],"total":0}}` ## Get Device Group Policies This API lets you retrieve a list of policies that are targeted on a device group. ### Endpoint - **URL:** `/v1/device-groups/{{group_id}}/policies` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------------------------------------------- | | `path_parameters.group_id` | string | Required | Parameters for the Get Device Group Policies action | ### Input Example `{"path_parameters":{"group_id":"U6gNvuC3QYurlf4ilNxlDg"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `policies` | array | Output field: policies | | `policies.name` | string | Name of the resource | | `policies.policy_type` | string | Type of the resource | | `policies.policy_uid` | string | Unique identifier | | `policies.policy_version` | number | Output field: policies.policy\_version | | `policies.target_apply_level` | string | Output field: policies.target\_apply\_level | | `policies.target_rules` | array | Output field: policies.target\_rules | | `policies.target_rules.version` | number | Output field: policies.target\_rules.version | | `policies.target_rules.enabled` | boolean | Output field: policies.target\_rules.enabled | | `policies.target_rules.sort_order` | number | Output field: policies.target\_rules.sort\_order | | `policies.targeted_date` | string | Date value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":10,"policies":[{"name":"Default Intrusion Prevention Policy","policy_type":"Network IPS","policy_uid":"9a2d5a12-4a4a-49d1-a55c-67012cdbd221","policy_version":1,"target_apply_level":"direct","target_rules":[{"version":1,"enabled":false,"sort_order":999999}],"targeted_date":"2021-05-20T00:00:00.000Z"},{"name":"Default Device Control Policy","policy_type":"Device Control","policy_uid":"d30aed4a-dff0-4270-8107-3297d15fe03c",...` ## Get Devices Retrieve the list of devices ### Endpoint - **URL:** `v1/devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------- | | `parameters.client_version` | array | Optional | Parameters for the Get Devices action | | `parameters.device_status` | array | Optional | Parameters for the Get Devices action | | `parameters.device_type` | string | Optional | Parameters for the Get Devices action | | `parameters.edr_enabled` | boolean | Optional | Parameters for the Get Devices action | | `parameters.is_cloud` | boolean | Optional | Parameters for the Get Devices action | | `parameters.is_online` | boolean | Optional | Parameters for the Get Devices action | | `parameters.is_virtual` | boolean | Optional | Parameters for the Get Devices action | | `parameters.name` | array | Optional | Parameters for the Get Devices action | | `parameters.os` | array | Optional | Parameters for the Get Devices action | ### Input Example `{"parameters":{"client_version":["14.3.202.3000","14.3.4615.2000"],"device_status":["AT_RISK","COMPROMISED","NOT_COMPUTED"],"device_type":"WORKSTATION","edr_enabled":false,"is_cloud":false,"is_online":true,"is_virtual":true,"name":["DESKTOP-LQJ2OUU","swim-mitm"],"os":["windows","Linux","iOS","Mac"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `devices` | array | Output field: devices | | `devices.id` | string | Unique identifier | | `devices.name` | string | Name of the resource | | `devices.host` | string | Output field: devices.host | | `devices.domain` | string | Output field: devices.domain | | `devices.created` | string | Output field: devices.created | | `devices.modified` | string | Output field: devices.modified | | `devices.os` | object | Output field: devices.os | | `devices.os.ver` | string | Output field: devices.os.ver | | `devices.os.name` | string | Name of the resource | | `devices.os.type` | string | Type of the resource | | `devices.os.64_bit` | boolean | Output field: devices.os.64\_bit | | `devices.os.lang` | string | Output field: devices.os.lang | | `devices.os.major_ver` | number | Output field: devices.os.major\_ver | | `devices.os.minor_ver` | number | Output field: devices.os.minor\_ver | | `devices.os.sp` | number | Output field: devices.os.sp | | `devices.os.tz_offset` | number | Output field: devices.os.tz\_offset | | `devices.os.user` | string | Output field: devices.os.user | | `devices.os.user_domain` | string | Output field: devices.os.user\_domain | | `devices.os.vol_avail_mb` | number | Output field: devices.os.vol\_avail\_mb | | `devices.os.vol_cap_mb` | number | Output field: devices.os.vol\_cap\_mb | | `devices.hw` | object | Output field: devices.hw | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 16:16:58 GMT","Content-Type":"application/json","Content-Length":"4427","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"38","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":4,"devices":[{"id":"4u_t38vBRrCg8LH2SoxHwg","name":"DESKTOP-QSI525C","host":"DESKTOP-QSI525C","domain":"","created":"2022-12-12T18:47:18.450Z","modified":"2022-12-22T...` ## Get File Finger Print List Gets the file fingerprint list for a specified ID as a set of hash values. A system administrator account is required for this action. ### Endpoint - **URL:** `api/v1/policy-objects/fingerprints/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ---------------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get File Finger Print List action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `hashType` | string | Type of the resource | | `source` | string | Output field: source | | `description` | string | Output field: description | | `data` | array | Response data | | `groupIds` | array | Unique identifier | ### Output Example `{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","hashType":"string","source":"string","description":"string","data":["string"],"groupIds":["string"]}` ## Get File Finger Print List By Name Gets the file fingerprint list for a specified Name as a set of hash values. A system administrator account is required for this action. ### Endpoint - **URL:** `api/v1/policy-objects/fingerprints` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------------------------ | | `parameters.name` | string | Required | Parameters for the Get File Finger Print List By Name action | | `parameters.domainId` | string | Optional | Parameters for the Get File Finger Print List By Name action | ### Input Example `{"parameters":{"name":"Example Name","domainId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `id` | string | Unique identifier | | `name` | string | Name of the resource | | `hashType` | string | Type of the resource | | `source` | string | Output field: source | | `description` | string | Output field: description | | `data` | array | Response data | | `groupIds` | array | Unique identifier | ### Output Example `{"id":"12345678-1234-1234-1234-123456789abc","name":"Example Name","hashType":"string","source":"string","description":"string","data":["string"],"groupIds":["string"]}` ## Get Incident Associate Events This task lets you retrieve incident associate events based on time range filter. ### Endpoint - **URL:** `v1/incidents/events` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `incident_associate` | boolean | Optional | Unique identifier | | `limit` | number | Optional | Parameter for Get Incident Associate Events | ### Input Example `{"json_body":{"incident_associate":true,"limit":100}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `events` | array | Output field: events | | `events.file_name` | string | Name of the resource | | `events.file` | string | Output field: events.file | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 26 Dec 2022 17:27:08 GMT","Content-Type":"application/json","Content-Length":"23","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"128","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":0,"events":[]}}` ## Get Incident By ID This Task lets you retrieve details for a specific incident. ### Endpoint - **URL:** `v1/incidents/{{id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Incident By ID action | ### Input Example `{"path_parameters":{"id":"700559b9-c260-4c76-b441-f5fc5bd08e6d"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":404,"response_headers":{"Date":"Fri, 23 Dec 2022 19:38:01 GMT","Content-Type":"application/json","Content-Length":"95","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"111","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"Incident summary is missing for incident Id: 700559b9-c260-4c76-b441-f5fc5bd08e6..."}}` ## Get Incidents This API lets you retrieve incidents and incident events. You can specify a search criteria to filter results. ### Endpoint - **URL:** `v1/incidents` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `start_date` | string | Optional | Date value | | `end_date` | string | Optional | Date value | | `next` | number | Optional | Parameter for Get Incidents | | `limit` | number | Optional | Parameter for Get Incidents | | `include_events` | boolean | Optional | Parameter for Get Incidents | | `query` | string | Optional | Parameter for Get Incidents | ### Input Example `{"json_body":{"start_date":"2022-11-25T22:46:09.230+0000","end_date":"2023-05-21T22:46:09.230+0000","next":0,"limit":10,"include_events":true,"query":"state_id: [0 TO 5] AND remediation:*Memory*"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `incidents` | array | Unique identifier | | `incidents.customer_uid` | string | Unique identifier | | `incidents.incident_uid` | string | Unique identifier | | `incidents.type` | string | Unique identifier | | `incidents.conclusion` | string | Unique identifier | | `incidents.remediation` | string | Unique identifier | | `incidents.priority_id` | number | Unique identifier | | `incidents.category_id` | number | Unique identifier | | `incidents.modified` | string | Unique identifier | | `incidents.state_id` | number | Unique identifier | | `incidents.id` | number | Unique identifier | | `incidents.product_uid` | string | Unique identifier | | `incidents.events` | array | Unique identifier | | `incidents.events.activity_id` | number | Unique identifier | | `incidents.events.actor` | object | Unique identifier | | `incidents.events.actor.cmd_line` | string | Unique identifier | | `incidents.events.actor.file` | object | Unique identifier | | `incidents.events.actor.file.company_name` | string | Unique identifier | | `incidents.events.actor.file.created` | number | Unique identifier | | `incidents.events.actor.file.folder` | string | Unique identifier | | `incidents.events.actor.file.md5` | string | Unique identifier | | `incidents.events.actor.file.name` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 22 Dec 2022 19:07:21 GMT","Content-Type":"application/json","Content-Length":"26","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"186","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"total":1,"incidents":[{}]}}` ## Get Lineage Events by Incident ID This Task lets you retrieve process lineage events for a specific incident. ### Endpoint - **URL:** `v1/incidents/{{incident_id}}/lineage` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `path_parameters.incident_id` | string | Required | Parameters for the Get Lineage Events by Incident ID action | ### Input Example `{"path_parameters":{"incident_id":"700559b9-c260-4c76-b441-f5fc5bd08e6d"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `message` | string | Response message | ### Output Example `{"status_code":404,"response_headers":{"Date":"Mon, 26 Dec 2022 17:36:20 GMT","Content-Type":"application/json","Content-Length":"89","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"29","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"Not Found","json_body":{"message":"There is no event uid for incident Id: 700559b9-c260-4c76-b441-f5fc5bd08e6d"}}` ## Get Policies This API lets you retrieve a list of your policies. ### Endpoint - **URL:** `/v1/policies` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Get Policies action | | `parameters.offset` | number | Optional | Parameters for the Get Policies action | | `parameters.name` | string | Optional | Parameters for the Get Policies action | | `parameters.type` | string | Optional | Parameters for the Get Policies action | ### Input Example `{"parameters":{"limit":100,"offset":1,"name":"test","type":"test"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `policies` | array | Output field: policies | | `policies.name` | string | Name of the resource | | `policies.author` | string | Output field: policies.author | | `policies.policy_uid` | string | Unique identifier | | `policies.policy_version` | number | Output field: policies.policy\_version | | `policies.policy_type` | string | Type of the resource | | `policies.is_imported` | boolean | Output field: policies.is\_imported | | `policies.created` | string | Output field: policies.created | | `policies.modified` | string | Output field: policies.modified | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":22,"policies":[{"name":"Default Adaptive Protection Policy","author":"System","policy_uid":"fb52866d-18d8-46af-9c3b-c071afc5041e","policy_version":1,"policy_type":"Behavioral Analysis","is_imported":false,"created":"2021-05-16T08:36:34.000Z","modified":"2021-05-16T08:36:34.000Z"},{"name":"Default Allow List Policy","author":"System","policy_uid":"d6c51743-6aa2-4c46-b95d-72da1d31e686","policy_version":1,"policy_type":"Exc...` ## Get Policy by ID This API lets you retrieve the details for a policy by using its uid and version. ### Endpoint - **URL:** `/v1/policies/{{policy_uid}}/versions/{{version}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------------ | | `path_parameters.policy_uid` | string | Required | Parameters for the Get Policy by ID action | | `path_parameters.version` | string | Required | Parameters for the Get Policy by ID action | | `headers` | object | Optional | HTTP headers for the request | | `headers.Accept` | string | Optional | HTTP headers for the request | ### Input Example `{"path_parameters":{"policy_uid":"915ab1a5-3e50-41c7-b054-244ceb5cbccf","version":"1"},"headers":{"Accept":"application/zip"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `attributes` | object | Output field: attributes | | `attributes.id` | string | Unique identifier | | `attributes.version` | number | Output field: attributes.version | | `attributes.schemaversion` | number | Output field: attributes.schemaversion | | `attributes.type` | number | Type of the resource | | `features` | array | Output field: features | | `features.configuration` | object | Output field: features.configuration | | `features.configuration.suspicious_behavior_enhancements` | string | Output field: features.configuration.suspicious\_behavior\_enhancements | | `features.configuration.suspicious_behavior_enhancement_rules` | array | Output field: features.configuration.suspicious\_behavior\_enhancement\_rules | | `features.configuration.suspicious_behavior_enhancement_rules.name` | string | Name of the resource | | `features.configuration.suspicious_behavior_enhancement_rules.desc` | string | Output field: features.configuration.suspicious\_behavior\_enhancement\_rules.desc | | `features.configuration.suspicious_behavior_enhancement_rules.action` | string | Output field: features.configuration.suspicious\_behavior\_enhancement\_rules.action | | `features.properties` | object | Output field: features.properties | | `features.properties.id` | string | Unique identifier | | `features.properties.name` | string | Name of the resource | | `features.properties.policy` | string | Output field: features.properties.policy | | `features.properties.policy_name` | string | Name of the resource | | `features.properties.version` | number | Output field: features.properties.version | | `features.properties.policy_subtype` | string | Type of the resource | | `locations` | array | Output field: locations | | `locations.file_name` | string | Name of the resource | | `locations.file` | string | Output field: locations.file | ### Output Example `{"attributes":{"id":"12345678-1234-1234-1234-123456789abc","version":123,"schemaversion":123,"type":123},"features":[{"configuration":{},"properties":{}}],"locations":[{"file_name":"Example Name","file":"string"}]}` ## Get Policy Target Rules This API lets you retrieve a list of target rules. ### Endpoint - **URL:** `/v1/policies/target-rules` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Get Policy Target Rules action | | `parameters.offset` | number | Optional | Parameters for the Get Policy Target Rules action | ### Input Example `{"parameters":{"limit":100,"offset":10}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | --------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `target_rules` | array | Output field: target\_rules | | `target_rules.name` | string | Name of the resource | | `target_rules.enabled` | boolean | Output field: target\_rules.enabled | | `target_rules.description` | string | Output field: target\_rules.description | | `target_rules.author` | string | Output field: target\_rules.author | | `target_rules.sort_order` | number | Output field: target\_rules.sort\_order | | `target_rules.created` | string | Output field: target\_rules.created | | `target_rules.modified` | string | Output field: target\_rules.modified | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":2,"target_rules":[{},{}]}}` ## Get Policy Versions This API lets you retrieve the versions of a policy. ### Endpoint - **URL:** `/v1/policies/{{policy_uid}}/versions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.policy_uid` | string | Required | Parameters for the Get Policy Versions action | ### Input Example `{"path_parameters":{"policy_uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `total` | number | Output field: total | | `policy_versions` | array | Output field: policy\_versions | | `policy_versions.policy_version` | number | Output field: policy\_versions.policy\_version | | `policy_versions.device_group_count` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"total":1,"policy_versions":[{}]}}` ## Patch Deny List Policy This API lets you perform partial update of Deny list policy. ### Endpoint - **URL:** `/v1/policies/deny-list/{{policy_uid}}/versions/{{version}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.policy_uid` | string | Required | Parameters for the Patch Deny List Policy action | | `path_parameters.version` | string | Required | Parameters for the Patch Deny List Policy action | | `add` | object | Optional | Parameter for Patch Deny List Policy | | `add.blacklistrules` | array | Optional | Parameter for Patch Deny List Policy | | `add.blacklistrules.processfile` | object | Optional | Parameter for Patch Deny List Policy | | `add.blacklistrules.processfile.md5` | string | Optional | Parameter for Patch Deny List Policy | | `add.blacklistrules.processfile.name` | string | Optional | Name of the resource | | `add.nonperules` | array | Optional | Parameter for Patch Deny List Policy | | `remove` | object | Optional | Parameter for Patch Deny List Policy | | `remove.blacklistrules` | array | Optional | Parameter for Patch Deny List Policy | | `remove.blacklistrules.processfile` | object | Optional | Parameter for Patch Deny List Policy | | `remove.blacklistrules.processfile.md5` | string | Optional | Parameter for Patch Deny List Policy | | `remove.nonperules` | array | Optional | Parameter for Patch Deny List Policy | ### Input Example `{"json_body":{"add":{"blacklistrules":[{"processfile":{"sha2":"cc58a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd","name":"My Sha256"}},{"processfile":{"sha2":"1287a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"B8EEA75B4224D8079BB86312528EF095","name":"My Md5 "}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7","name":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"name":"--","sha2":"CC58A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900},"actor":{}},{"file":{"name":"Non-Ex md5 - with app access file","md5":"787EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"name":"Non-Ex md5 - with app access fingerprint","md5":"123EAF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"name":"Non-Ex md5 - with file path","md5":"2F305D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"},"actor":{}},{"file":{"name":"Non-Ex md5 - with file size","md5":"E27F35B2D30423CD3A281375585E22F9","size":500},"actor":{}},{"file":{"name":"Non-Ex sha256 - with app access file","sha2":"4AFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"},"actor":{"directory":"c:/gest/myfle.exe"}},{"file":{"name":"Non-Ex sha256 - with app access fingerprint","sha2":"3FFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496F123"},"actor":{"sha2":"123ABF6A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"}},{"file":{"name":"Non-Ex sha256 - with file path","sha2":"7AFCC2C38AC334047F0CC957708E5B32CFCB15F72F4C22C9EC53FF48339922B9","directory":"c:\\testloc\\myfile.txt"},"actor":{}},{"file":{"name":"Non-Ex sha256 - with file size","sha2":"BF9C02EA1745BE0A3227FD0841EA53ED6D361006F13DD62677AEB4EED00E0BC5","size":200},"actor":{}}]},"remove":{"blacklistrules":[{"processfile":{"sha2":"6666a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"sha2":"9998A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900}},{"file":{"md5":"555EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"md5":"1333AF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"md5":"20878D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"}}]}},"path_parameters":{"policy_uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `author` | string | Output field: author | | `policy_uid` | string | Unique identifier | | `policy_version` | number | Output field: policy\_version | | `policy_type` | string | Type of the resource | | `is_imported` | boolean | Output field: is\_imported | | `locked` | boolean | Output field: locked | | `created` | string | Output field: created | | `modified` | string | Output field: modified | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Deny List Policy - update name","author":"Client Application\\My Client11","policy_uid":"ebe8835f-a84d-4538-85f6-5f3ed450a2d2","policy_version":3,"policy_type":"Deny List","is_imported":false,"locked":true,"created":"2022-08-29T11:14:45.000Z","modified":"2022-08-30T09:54:51.000Z"}}` ## Process Dump Command This Task lets you send the process dump command on the device. ### Endpoint - **URL:** `v1/commands/endpoint-search/processdump` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------- | | `device_id` | string | Optional | Unique identifier | | `hash` | string | Optional | Parameter for Process Dump Command | | `description` | string | Optional | Parameter for Process Dump Command | ### Input Example `{"json_body":{"device_id":"4u_t38vBRrCg8LH2SoxHwg","hash":"c4e078607db2784be7761c86048dffa6f3ef04b551354a32fcdec3b6a3450905","description":"test"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.command_type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Fri, 23 Dec 2022 20:46:05 GMT","Content-Type":"application/json","Content-Length":"209","Connection":"keep-alive","Server":"envoy","x-envoy-upstream-service-time":"1059","Via":"1.1 google","Alt-Svc":"h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000"},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Quarantine Device This API lets you quarantine devices managed by your Integrate Cyber Defense Manager. ### Endpoint - **URL:** `v1/commands/contain` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------- | | `device_ids` | array | Optional | Unique identifier | | `org_unit_ids` | array | Optional | Unique identifier | | `payload` | object | Optional | Parameter for Quarantine Device | | `payload.quarantine_host_group_name` | string | Optional | Name of the resource | | `is_recursive` | boolean | Optional | Parameter for Quarantine Device | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"payload":{"quarantine_host_group_name":"test_group_name"},"is_recursive":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Quick Scan Runs a quick scan ### Endpoint - **URL:** `v1/commands/scans/quick` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------ | | `device_ids` | array | Optional | Unique identifier | | `org_unit_ids` | array | Optional | Unique identifier | | `is_recursive` | boolean | Optional | Parameter for Quick Scan | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Restart Device This API lets you reboot devices that are managed by your Integrated Cyber Defense Manager Defense Manager. ### Endpoint - **URL:** `v1/commands/restart` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------- | | `device_ids` | array | Optional | Unique identifier | | `payload` | object | Optional | Parameter for Restart Device | | `payload.prompt_type` | string | Optional | Type of the resource | | `payload.schedule_type` | string | Optional | Type of the resource | | `payload.reason_type` | string | Optional | Type of the resource | | `payload.message` | string | Optional | Response message | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"payload":{"prompt_type":"prompt","schedule_type":"later","reason_type":"remediation","message":"This is a restart test"}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Unquarantine Device Unquarantine devices managed by your Integrated Cyber Defense Manager ### Endpoint - **URL:** `v1/commands/allow` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `device_ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Update BlackList Updates an existing blacklist. A system administrator account is required for this action. ### Endpoint - **URL:** `api/v1/policy-objects/fingerprints/{{id}}` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Update BlackList action | | `name` | string | Optional | Name of the resource | | `domainId` | string | Optional | Unique identifier | | `hashType` | string | Optional | Type of the resource | | `description` | string | Optional | Parameter for Update BlackList | | `data` | array | Optional | Response data | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"name":"Example Name","domainId":"string","hashType":"string","description":"string","data":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Update Content This API lets you update security definitions and content of devices managed by your Integrated Cyber Defense Manager. ### Endpoint - **URL:** `v1/commands/update_content` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------- | | `device_ids` | array | Optional | Unique identifier | | `org_unit_ids` | array | Optional | Unique identifier | | `is_recursive` | boolean | Optional | Parameter for Update Content | ### Input Example `{"json_body":{"device_ids":["40PfcIOGQtmj3-eIjLG5sA","ehH_9sDfTeOH-vG5g6mqo2"],"org_unit_ids":["jC9gVcA-QI2JxN6UbDllEw","jC9gVcA-QI2JxN6UbDllEz"],"is_recursive":false}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `status` | number | Status value | | `status_text` | string | Status value | | `results` | object | Result of the operation | | `results.data` | array | Response data | | `results.data.command_state_ref` | string | Response data | | `results.data.device_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"status":200,"status_text":"200 OK","results":{"data":[]}}}` ## Update Deny List Policy This API lets you perform update of Deny list policy. ### Endpoint - **URL:** `/v1/policies/deny-list/{{policy_uid}}/versions/{{version}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------------------- | -------- | ------------ | ------------------------------------------------- | | `path_parameters.policy_uid` | string | Required | Parameters for the Update Deny List Policy action | | `path_parameters.version` | string | Required | Parameters for the Update Deny List Policy action | | `features` | array | Optional | Parameter for Update Deny List Policy | | `features.configuration` | object | Optional | Parameter for Update Deny List Policy | | `features.configuration.blacklistrules` | array | Optional | Parameter for Update Deny List Policy | | `features.configuration.blacklistrules.processfile` | object | Optional | Parameter for Update Deny List Policy | | `features.configuration.blacklistrules.processfile.md5` | string | Optional | Parameter for Update Deny List Policy | | `features.configuration.blacklistrules.processfile.name` | string | Optional | Name of the resource | | `features.configuration.nonperules` | array | Optional | Parameter for Update Deny List Policy | | `features.properties` | object | Optional | Parameter for Update Deny List Policy | | `features.properties.policy_name` | string | Optional | Name of the resource | | `features.state` | object | Optional | Parameter for Update Deny List Policy | | `features.state.locked` | boolean | Optional | Parameter for Update Deny List Policy | ### Input Example `{"json_body":{"features":[{"configuration":{"blacklistrules":[{"processfile":{"sha2":"cc58a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd","name":"My Sha256"}},{"processfile":{"sha2":"1287a84bad103041396af249a16a1d16cbf698868d5388d8951f14d1403559bd"}},{"processfile":{"md5":"B8EEA75B4224D8079BB86312528EF095","name":"My Md5 "}},{"processfile":{"md5":"EF22AF4E07F0457FDD0CDAF68F712DF7","name":"EF22AF4E07F0457FDD0CDAF68F712DF7"}}],"nonperules":[{"file":{"name":"--","sha2":"CC58A84BAD103041396AF249A16A1D16CBF698868D5388D8951F14D1403559BD","size":900},"actor":{}},{"file":{"name":"Non-Ex md5 - with app access file","md5":"787EAF4E07F0457FDD0CDAF68F712DF7"},"actor":{"directory":"c:\\testloc\\test124\\ttemdj.exe"}},{"file":{"name":"Non-Ex md5 - with app access fingerprint","md5":"123EAF4E07F0457FDD0CDAF68F712DAB"},"actor":{"md5":"A23BAF4E07F0457FDD0CDAF68F712DCD"}},{"file":{"name":"Non-Ex md5 - with file path","md5":"2F305D3E26033D128F3741A18150CF2E","directory":"c:/testmylocation/testloc2/thisfile.doc"},"actor":{}},{"file":{"name":"Non-Ex md5 - with file size","md5":"E27F35B2D30423CD3A281375585E22F9","size":500},"actor":{}},{"file":{"name":"Non-Ex sha256 - with app access file","sha2":"4AFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"},"actor":{"directory":"c:/gest/myfle.exe"}},{"file":{"name":"Non-Ex sha256 - with app access fingerprint","sha2":"3FFA016A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496F123"},"actor":{"sha2":"123ABF6A9DBC2F1DA43F4A71C62E4653AFE0F2E2A6B4722698525086F496FBD2"}},{"file":{"name":"Non-Ex sha256 - with file path","sha2":"7AFCC2C38AC334047F0CC957708E5B32CFCB15F72F4C22C9EC53FF48339922B9","directory":"c:\\testloc\\myfile.txt"},"actor":{}},{"file":{"name":"Non-Ex sha256 - with file size","sha2":"BF9C02EA1745BE0A3227FD0841EA53ED6D361006F13DD62677AEB4EED00E0BC5","size":200},"actor":{}}]},"properties":{"policy_name":"Deny List Policy - update name"},"state":{"locked":false}}]},"path_parameters":{"policy_uid":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `author` | string | Output field: author | | `policy_uid` | string | Unique identifier | | `policy_version` | number | Output field: policy\_version | | `policy_type` | string | Type of the resource | | `is_imported` | boolean | Output field: is\_imported | | `locked` | boolean | Output field: locked | | `created` | string | Output field: created | | `modified` | string | Output field: modified | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Deny List - 30 Aug","author":"Client Application\\My Client11","policy_uid":"55dd0dbe-4ce9-4184-b601-4b6ec984bca2","policy_version":3,"policy_type":"Deny List","is_imported":false,"locked":true,"created":"2022-08-29T11:14:45.000Z","modified":"2022-08-30T09:54:51.000Z"}}` ## Update Policy This API lets you update policy with new configurations. ### Endpoint - **URL:** `/v1/policies` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------------------------ | -------- | ------------ | --------------------------- | | `attributes` | object | Optional | Parameter for Update Policy | | `attributes.id` | string | Optional | Unique identifier | | `attributes.version` | number | Optional | Parameter for Update Policy | | `attributes.schemaversion` | number | Optional | Parameter for Update Policy | | `attributes.type` | number | Optional | Type of the resource | | `features` | array | Optional | Parameter for Update Policy | | `features.configuration` | object | Optional | Parameter for Update Policy | | `features.configuration.rule_sets` | array | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.name` | string | Optional | Name of the resource | | `features.configuration.rule_sets.description` | string | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.enabled` | boolean | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.mode` | string | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.version` | number | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.log_action` | number | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules` | array | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.name` | string | Optional | Name of the resource | | `features.configuration.rule_sets.control_rules.description` | string | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.enabled` | boolean | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.child_process` | boolean | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.processes` | array | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.exclude_processes` | array | Optional | Parameter for Update Policy | | `features.configuration.rule_sets.control_rules.condition_list` | array | Optional | Parameter for Update Policy | | `features.properties` | object | Optional | Parameter for Update Policy | | `features.properties.id` | string | Optional | Unique identifier | | `features.properties.name` | string | Optional | Name of the resource | ### Input Example `{"json_body":{"attributes":{"id":"string","version":100,"schemaversion":100,"type":100},"features":[{"configuration":{"rule_sets":[{"name":"Block programs from running from removable drives [AC2]","description":"This rule will block any program from running from any removable media, including floppies, USB flash drives, CD/DVD drives and other drives, such as Zip and Jazz drives.","enabled":false,"mode":"PRODUCTION","version":0,"log_action":1,"control_rules":[{"name":"Block running applications from removable media","description":" ","enabled":true,"child_process":false,"processes":[{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":false,"enable_device_instance":false}}],"exclude_processes":[],"condition_list":[{"name":"Block programs from running from removable drives [AC2]","description":"This rule will block any program from running from any removable media, including floppies, USB flash drives, CD/DVD drives and other drives, such as Zip and Jazz drives.","enabled":1,"launch_process_condition":{"action":{"action":"BLOCK","severity":3,"log_action":1},"processes":[{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":true,"drive_types":["REMOVABLE","CD_DVD"],"enable_device_instance":false}},{"file":{"enable_checksum":false,"enable_name":true,"name":"*","regex":false,"enable_drive_types":false,"enable_device_instance":true,"device_instance_id":"USBSTOR*"}}],"exclude_processes":[]}}]}]}]},"properties":{"id":"{25DFB16F-A981-476C-8D1E-D6AB79FE97AC}","name":"APP_CONTROL_LITE","policy":"0f311289-bf45-4c97-b7eb-3db508827c87","policy_name":"Default Custom Application Behaviors Policy","version":1,"policy_subtype":"EG"},"state":{"locked":true}}],"locations":[],"type":"APP_CONTROL_LITE"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `author` | string | Output field: author | | `policy_uid` | string | Unique identifier | | `policy_version` | number | Output field: policy\_version | | `policy_type` | string | Type of the resource | | `is_imported` | boolean | Output field: is\_imported | | `locked` | boolean | Output field: locked | | `created` | string | Output field: created | | `modified` | string | Output field: modified | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"name":"Broadcom policy name","author":"Client Application\\My Client11","policy_uid":"1d3fd28f-4d10-4089-8c01-b3604dfbc564","policy_version":1,"policy_type":"Custom Application Behavior","is_imported":false,"locked":true,"created":"2022-08-29T10:32:47.000Z","modified":"2022-08-30T09:49:54.000Z"}}` # Response Headers | **Header** | **Description** | **Example** | | ----------------------------- | ---------------------------------------------------------- | ---------------------------------------------- | | Alt-Svc | HTTP response header: Alt-Svc | h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 | | cache-control | Directives for caching mechanisms | no-cache, no-store, max-age=0, must-revalidate | | Connection | HTTP response header: Connection | keep-alive | | Content-Length | The length of the response body in bytes | 25 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Fri, 23 Dec 2022 20:46:05 GMT | | expires | The date/time after which the response is considered stale | 0 | | pragma | HTTP response header: pragma | no-cache | | Server | Information about the software used by the origin server | envoy | | Via | HTTP response header: Via | 1.1 google | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 1052 | | x-frame-options | HTTP response header: x-frame-options | DENY | | x-xss-protection | HTTP response header: x-xss-protection | 1; mode=block |