--- title: Tanium Threat Response slug: connectors/tanium-threat-response docTags: createdAt: 2026-06-09T16:29:57.846Z --- ## Prerequisites To authenticate this connector, you need an **API Token**. ## Capabilities This connector provides the following capabilities: - Create Connection - Create liveResponse Action - Download File Evidence - Get Alert by ID - Get Collection Configs - Get Intel Doc by ID - Get Response Actions - List Alerts - List Connections - List File Evidence - Update Alert State by ID ## Asset Setup To generate an API Token, please follow the instructions below: - From the homepage after logging into your Tanium instance, Navigate to **Administration** -> **API Tokens** - Click on **New API Token** at the right side of the page. - Set the Expiration, Persona and Trusted IP Addresses details and click on **Create**. Note: Only IP addresses mentioned in **Trusted IP Addresses**, will be able to make successful connections to the API. If you want to allow any IP, use **0.0.0.0/0** as the Trusted IP address. # Configurations ## Tanium Threat Response API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | session | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create Connection Create a user connection. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/conns/connect` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------- | | `target` | object | Optional | Parameter for Create Connection | | `target.hostname` | string | Optional | Name of the resource | | `target.clientId` | string | Optional | Unique identifier | | `target.platform` | string | Optional | Parameter for Create Connection | | `target.ip` | string | Optional | Parameter for Create Connection | ### Input Example `{"json_body":{"target":{"hostname":"localhost","clientId":"2871630594","platform":"Linux","ip":"10.70.145.92"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":202,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"0dc48760-a134-4fb1-81b3-7775eaccced0","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## Create liveResponse Action Creates a new liveResponse action. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/response-actions` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------- | | `type` | string | Optional | Response action type. Do not change. | | `computerName` | string | Optional | Name of the resource | | `eid` | number | Optional | Unique identifier | | `options` | object | Optional | Parameter for Create liveResponse Action | | `options.packageName` | string | Required | Package to deploy for this response action. | | `options.packageParameters` | array | Required | Parameters for the package being deployed. At least 4 parameters should be defined. | | `options.packageParameters.key` | string | Optional | Parameters for the Create liveResponse Action action | | `options.packageParameters.value` | string | Optional | Parameters for the Create liveResponse Action action | | `expirationTime` | string | Optional | Time value | ### Input Example `{"json_body":{"type":"liveResponse","computerName":"computerName","eid":4,"options":{"packageName":"Threat Response - Live Response [Windows]","packageParameters":[{"key":"$1","value":"Memory Collection"},{"key":"$2","value":"test aws"},{"key":"$3","value":"collectionSet"},{"key":"$4","value":"DestinationSet"}]},"expirationTime":"2019-09-20T13:50:53.699Z"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ---------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.type` | string | Response data | | `data.computerName` | string | Response data | | `data.options` | object | Response data | | `data.options.packageName` | string | Response data | | `data.options.packageParameters` | array | Parameters for the Create liveResponse Action action | | `data.options.packageParameters.key` | string | Parameters for the Create liveResponse Action action | | `data.options.packageParameters.value` | string | Parameters for the Create liveResponse Action action | | `data.options.packageSkipLockFlag` | boolean | Response data | | `data.status` | string | Response data | | `data.userId` | number | Response data | | `data.personaId` | object | Response data | | `data.userName` | string | Response data | | `data.results` | object | Response data | | `data.expirationTime` | string | Response data | | `data.createdAt` | string | Response data | | `data.updatedAt` | string | Response data | | `data.id` | number | Response data | | `data.eid` | object | Response data | ### Output Example `{"status_code":201,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"44bbb276-26ce-4a5d-9952-d1bfb3a57442","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## Download File Evidence Download the File Evidence File. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/filedownload/data/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Download File Evidence action | ### Input Example `{"path_parameters":{"id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | ----------------------- | | `file` | object | Attachments | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":{"file":"string","file_name":"Example Name"}}` ## Get Alert by ID Get an alert by ID. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/alerts/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ----------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Get Alert by ID action | ### Input Example `{"path_parameters":{"id":123}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.state` | string | Response data | | `data.type` | string | Response data | | `data.guid` | string | Response data | | `data.priority` | object | Response data | | `data.severity` | string | Response data | | `data.intelDocId` | number | Response data | | `data.intelDocRevisionId` | number | Response data | | `data.scanConfigId` | number | Response data | | `data.scanConfigRevisionId` | number | Response data | | `data.computerName` | string | Response data | | `data.computerIpAddress` | string | Response data | | `data.eid` | number | Response data | | `data.details` | string | Response data | | `data.alertedAt` | string | Response data | | `data.createdAt` | string | Response data | | `data.updatedAt` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"dad03cb0-49fc-49e4-86ec-e5f2165dd8fd","tanium-threat-response-version":"4.5.126.0000","content-encoding":"gzip","cache-control":...` ## Get Collection Configs Gets all of the live response collection configs, with offset, limit. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/liveresponse/collectionConfigs` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.limit` | number | Optional | Parameters for the Get Collection Configs action | | `parameters.offset` | number | Optional | Parameters for the Get Collection Configs action | ### Input Example `{"parameters":{"limit":1000,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | number | Response data | | `data.name` | string | Response data | | `data.description` | string | Response data | | `data.enabledModules` | array | Response data | | `data.enabled` | boolean | Response data | | `data.userDefined` | boolean | Response data | | `data.revision` | number | Response data | | `data.createdAt` | string | Response data | | `data.updatedAt` | string | Response data | | `data.hashes` | array | Response data | | `data.fileCollectors` | array | Response data | | `data.fileCollectors.file_name` | string | Response data | | `data.fileCollectors.file` | string | Response data | | `data.fileCollectorSets` | array | Response data | | `data.fileCollectorSets.id` | number | Response data | | `data.fileCollectorSets.name` | string | Response data | | `data.fileCollectorSets.description` | string | Response data | | `data.fileCollectorSets.enabled` | boolean | Response data | | `data.fileCollectorSets.userDefined` | boolean | Response data | | `data.fileCollectorSets.revision` | number | Response data | | `data.fileCollectorSets.createdAt` | string | Response data | | `data.fileCollectorSets.updatedAt` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"04d59489-3380-4d86-9b6c-1439da1c4a89","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## Get Intel Doc by ID Get intel doc by ID. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/intels/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Get Intel Doc by ID action | ### Input Example `{"path_parameters":{"id":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.id` | number | Response data | | `data.revisionId` | number | Response data | | `data.type` | string | Response data | | `data.typeVersion` | string | Response data | | `data.intrinsicId` | string | Response data | | `data.md5` | string | Response data | | `data.name` | string | Response data | | `data.description` | string | Response data | | `data.size` | number | Response data | | `data.alertCount` | number | Response data | | `data.unresolvedAlertCount` | number | Response data | | `data.throttledFindingCount` | number | Response data | | `data.labelIds` | array | Response data | | `data.labelIds.file_name` | string | Response data | | `data.labelIds.file` | string | Response data | | `data.sourceId` | number | Response data | | `data.blobId` | string | Response data | | `data.isSchemaValid` | boolean | Response data | | `data.contents` | string | Response data | | `data.createdAt` | string | Response data | | `data.updatedAt` | string | Response data | | `data.allowAutoDisable` | boolean | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"dad03cb0-49fc-49e4-86ec-e5f2165dd8fd","tanium-threat-response-version":"4.5.126.0000","content-encoding":"gzip","cache-control":...` ## Get Response Actions Gets all response actions. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/response-actions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.offset` | number | Optional | Parameters for the Get Response Actions action | | `parameters.limit` | number | Optional | Parameters for the Get Response Actions action | | `parameters.sortBy` | string | Optional | Parameters for the Get Response Actions action | | `parameters.sortOrder` | string | Optional | Parameters for the Get Response Actions action | | `parameters.queryPartialComputerName` | string | Optional | Parameters for the Get Response Actions action | | `parameters.queryStatus` | string | Optional | Parameters for the Get Response Actions action | | `parameters.queryType` | string | Optional | Parameters for the Get Response Actions action | ### Input Example `{"parameters":{"offset":0,"limit":1000,"sortBy":"createdAt","sortOrder":"asc","queryPartialComputerName":"ComputerName","queryStatus":"QUEUED","queryType":"liveResponse"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.id` | number | Response data | | `data.type` | string | Response data | | `data.status` | string | Response data | | `data.computerName` | string | Response data | | `data.userId` | number | Response data | | `data.personaId` | object | Response data | | `data.userName` | string | Response data | | `data.options` | object | Response data | | `data.options.packageName` | string | Response data | | `data.options.packageParameters` | array | Parameters for the Get Response Actions action | | `data.options.packageParameters.key` | string | Parameters for the Get Response Actions action | | `data.options.packageParameters.value` | string | Parameters for the Get Response Actions action | | `data.options.packageSkipLockFlag` | boolean | Response data | | `data.results` | object | Response data | | `data.results.taskIds` | array | Response data | | `data.results.actionIds` | array | Response data | | `data.results.actionIds.file_name` | string | Response data | | `data.results.actionIds.file` | string | Response data | | `data.results.errorCount` | number | Response data | | `data.results.retryCount` | number | Response data | | `data.expirationTime` | string | Response data | | `data.createdAt` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"b4a6f11b-3743-484f-8c7e-3d3f0f8f3167","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## List Alerts List alerts with optional filtering, sorting, and pagination. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------- | | `parameters.state` | string | Optional | Parameters for the List Alerts action | | `parameters.type` | string | Optional | Parameters for the List Alerts action | | `parameters.matchType` | string | Optional | Parameters for the List Alerts action | | `parameters.path` | string | Optional | Parameters for the List Alerts action | | `parameters.priority` | string | Optional | Parameters for the List Alerts action | | `parameters.severity` | string | Optional | Parameters for the List Alerts action | | `parameters.intelDocId` | number | Optional | Parameters for the List Alerts action | | `parameters.intelType` | string | Optional | Parameters for the List Alerts action | | `parameters.intelDocName` | string | Optional | Parameters for the List Alerts action | | `parameters.intelSource` | string | Optional | Parameters for the List Alerts action | | `parameters.labelName` | string | Optional | Parameters for the List Alerts action | | `parameters.mitreId` | string | Optional | Parameters for the List Alerts action | | `parameters.scanConfigId` | number | Optional | Parameters for the List Alerts action | | `parameters.computerName` | string | Optional | Parameters for the List Alerts action | | `parameters.computerIpAddress` | string | Optional | Parameters for the List Alerts action | | `parameters.platform` | string | Optional | Parameters for the List Alerts action | | `parameters.details` | string | Optional | Parameters for the List Alerts action | | `parameters.alertedAtFrom` | string | Optional | Parameters for the List Alerts action | | `parameters.alertedAtUntil` | string | Optional | Parameters for the List Alerts action | | `parameters.guid` | string | Optional | Parameters for the List Alerts action | | `parameters.include` | string | Optional | Parameters for the List Alerts action | | `parameters.sort` | string | Optional | Parameters for the List Alerts action | | `parameters.expand` | string | Optional | Parameters for the List Alerts action | | `parameters.limit` | number | Optional | Parameters for the List Alerts action | | `parameters.offset` | number | Optional | Parameters for the List Alerts action | ### Input Example `{"parameters":{"state":"string","type":"string","matchType":"string","path":"string","priority":"string","severity":"string","intelDocId":123,"intelType":"string","intelDocName":"Example Name","intelSource":"string","labelName":"Example Name","mitreId":"string","scanConfigId":123,"computerName":"Example Name","computerIpAddress":"string","platform":"string","details":"string","alertedAtFrom":"string","alertedAtUntil":"string","guid":"string","include":"string","sort":"string","expand":"string","limit":123,"offset":123}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.totalCount` | number | Count value | | `meta.filteredCount` | number | Count value | | `data` | array | Response data | | `data.id` | number | Response data | | `data.state` | string | Response data | | `data.type` | string | Response data | | `data.guid` | string | Response data | | `data.priority` | object | Response data | | `data.severity` | string | Response data | | `data.intelDocId` | number | Response data | | `data.intelDocRevisionId` | number | Response data | | `data.scanConfigId` | number | Response data | | `data.scanConfigRevisionId` | number | Response data | | `data.computerName` | string | Response data | | `data.computerIpAddress` | string | Response data | | `data.eid` | number | Response data | | `data.details` | object | Response data | | `data.matchType` | string | Response data | | `data.path` | string | Response data | | `data.alertedAt` | string | Response data | | `data.createdAt` | string | Response data | | `data.updatedAt` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"dad03cb0-49fc-49e4-86ec-e5f2165dd8fd","tanium-threat-response-version":"4.5.126.0000","content-encoding":"gzip","cache-control":...` ## List Connections List user connections. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/conns` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"4cb9ada9-7f2a-4d3e-8ae1-552a43853b01","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## List File Evidence Get all file evidence records from the database. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/filedownload` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.limit` | number | Optional | Maximum number of results to return. Default - 1000 | | `parameters.offset` | number | Optional | Offset into the result set. Default - 0 | | `parameters.sort` | string | Optional | Column by which to sort. Default - downloaded | ### Input Example `{"parameters":{"limit":1000,"offset":0,"sort":"downloaded"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `fileEvidence` | array | Unique identifier | | `fileEvidence.uuid` | string | Unique identifier | | `fileEvidence.hostname` | string | Unique identifier | | `fileEvidence.path` | string | Unique identifier | | `fileEvidence.downloaded` | string | Unique identifier | | `fileEvidence.hash` | string | Unique identifier | | `fileEvidence.size` | number | Unique identifier | | `fileEvidence.created` | string | Unique identifier | | `fileEvidence.created_by` | string | Unique identifier | | `fileEvidence.created_by_proc` | string | Unique identifier | | `fileEvidence.last_modified` | string | Unique identifier | | `fileEvidence.last_modified_by` | string | Unique identifier | | `fileEvidence.last_modified_by_proc` | string | Unique identifier | | `fileEvidence.tags` | string | Unique identifier | | `fileEvidence.comments` | string | Unique identifier | | `fileEvidence.createdAt` | string | Unique identifier | | `fileEvidence.updatedAt` | string | Unique identifier | | `totalCount` | number | Count value | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"7da57a9c-244b-4f9d-bd46-cb7579476934","tanium-threat-response-version":"4.5.131.0000","content-encoding":"gzip","cache-control":...` ## Update Alert State by ID Update the state of a single alert by ID. ### Endpoint - **URL:** `/plugin/products/threat-response/api/v1/alerts/{{id}}` - **Method:** `PUT` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | -------------------------------------------------- | | `path_parameters.id` | number | Required | Parameters for the Update Alert State by ID action | | `state` | string | Optional | Parameter for Update Alert State by ID | ### Input Example `{"path_parameters":{"id":123},"state":"string"}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `alert` | object | Output field: alert | | `alert.id` | number | Unique identifier | | `alert.state` | string | Output field: alert.state | | `alert.type` | string | Type of the resource | | `alert.guid` | string | Unique identifier | | `alert.priority` | object | Output field: alert.priority | | `alert.severity` | string | Output field: alert.severity | | `alert.intelDocId` | number | Unique identifier | | `alert.intelDocRevisionId` | number | Unique identifier | | `alert.scanConfigId` | number | Unique identifier | | `alert.scanConfigRevisionId` | number | Unique identifier | | `alert.computerName` | string | Name of the resource | | `alert.computerIpAddress` | string | Output field: alert.computerIpAddress | | `alert.eid` | number | Unique identifier | | `alert.details` | string | Output field: alert.details | | `alert.matchType` | string | Type of the resource | | `alert.path` | string | Output field: alert.path | | `alert.alertedAt` | string | Output field: alert.alertedAt | | `alert.createdAt` | string | Output field: alert.createdAt | | `alert.updatedAt` | string | Output field: alert.updatedAt | ### Output Example `{"status_code":200,"response_headers":{"x-frame-options":"SAMEORIGIN","x-content-type-options":"nosniff","x-xss-protection":"1","referrer-policy":"no-referrer","strict-transport-security":"max-age=63072000; includeSubDomains;","content-security-policy":"default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 's...","server":"envoy","x-request-id":"dad03cb0-49fc-49e4-86ec-e5f2165dd8fd","tanium-threat-response-version":"4.5.126.0000","content-encoding":"gzip","cache-control":...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------------ | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | cache-control | Directives for caching mechanisms | no-cache, no-store, must-revalidate | | content-encoding | HTTP response header: content-encoding | gzip | | content-security-policy | HTTP response header: content-security-policy | default-src 'self';script-src 'self' 'unsafe-eval';frame-src 'self';child-src 'self';worker-src 'self';media-src 'self';style-src 'self' 'unsafe-inline';img-src data: blob: 'self';frame-ancestors 'self';font-src 'self' data:;upgrade-insecure-requests;connect-src \* data: blob: 'unsafe-inline';block-all-mixed-content; | | Content-Type | The media type of the resource | application/json | | date | The date and time at which the message was originated | Mon, 18 Mar 2024 06:54:23 GMT | | expires | The date/time after which the response is considered stale | 0 | | pragma | HTTP response header: pragma | no-cache | | referrer-policy | HTTP response header: referrer-policy | no-referrer | | server | Information about the software used by the origin server | envoy | | strict-transport-security | HTTP response header: strict-transport-security | max-age=63072000; includeSubDomains; | | tanium-threat-response-version | HTTP response header: tanium-threat-response-version | 4.5.131.0000 | | transfer-encoding | HTTP response header: transfer-encoding | chunked | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-envoy-upstream-service-time | HTTP response header: x-envoy-upstream-service-time | 463 | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-request-id | A unique identifier for the request | 0dc48760-a134-4fb1-81b3-7775eaccced0 | | x-xss-protection | HTTP response header: x-xss-protection | 1 |