Vali Cyber ZeroLock

The ZeroLock platform addresses the entire Linux threat landscape from ransomware to cryptojacking. ZeroLock goes beyond traditional mandatory access control capabilities. In contrast to SELinux and AppArmor, ZeroLock offers easily configured and universally applied rules and policies that can be deployed across all your Linux and cloud environments from a single console.

Prerequisites

You need an username and password to authenticate the connector.

Capabilities

This connector provides the following capabilities:

Archive Endpoints

Change Agent Version

Create User

Get Alert Details by ID

Get Alert List

Get Alerts by Time

Get Alerts per Endpoint

Get Endpoint Count

Get Endpoint Data by ID

Get Endpoint Uptime

Get Frontend Table Alert List

Get Number of Alerts

Get Summary Information about Protected Endpoints

Kill Alert by ID

Kill Alerts ... and so on

Notes

API Documentation

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Archive Endpoints

Archive a list of endpoints by ID.

Endpoint

URL: /api/v2/endpoints/archiveEndpoints

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointIds	array	Required	Parameters for the Archive Endpoints action

Input Example

{"parameters":{"endpointIds":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointIds	array	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	string	Response content

Output Example

{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...

Change Agent Version

Uninstalls the agent and reinstalls a specified version on an endpoint.

Endpoint

URL: /api/v2/endpoints/changeAgentVersion

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointIds	array	Required	Parameters for the Change Agent Version action
parameters.token	string	Required	Secure token which indicates ownership of installed endpoint.
parameters.version	string	Required	Parameters for the Change Agent Version action

Input Example

{"parameters":{"endpointIds":["string"],"token":"string","version":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointIds	array	Unique identifier
args.version	string	Output field: args.version
args.token	string	Output field: args.token
args.limitRefresh	string	Output field: args.limitRefresh
args.query	string	Output field: args.query
content	string	Response content

Output Example

Create User

Creates a new user.

Endpoint

URL: /api/v2/users/createUser

Method: POST

Input

Argument Name	Type	Required	Description
parameters.email	string	Required	Parameters for the Create User action
parameters.firstname	string	Optional	Parameters for the Create User action
parameters.lastname	string	Optional	Parameters for the Create User action
parameters.telephone	string	Optional	Parameters for the Create User action
parameters.title	string	Optional	Parameters for the Create User action
parameters.roleId	string	Optional	Parameters for the Create User action
parameters.SSO	boolean	Optional	Parameters for the Create User action
parameters.tenantId	string	Optional	Parameters for the Create User action

Input Example

{"parameters":{"email":"[email protected]","firstname":"Example Name","lastname":"Example Name","telephone":"string","title":"string","roleId":"string","SSO":true,"tenantId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content

Output Example

Get Alert Details by ID

Return all details for one alert by its ID.

Endpoint

URL: /api/v2/alerts/alertDetails

Method: POST

Input

Argument Name	Type	Required	Description
parameters.id	string	Required	Parameters for the Get Alert Details by ID action

Input Example

{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.id	string	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.type	string	Type of the resource
content.id	number	Unique identifier
content.endpoint	string	Response content
content.processId	number	Unique identifier
content.endpointId	number	Unique identifier
content.info	string	Response content
content.status	string	Status value
content.actionData	object	Response data
content.createdAt	string	Response content
content.updatedAt	string	Response content
content.severity	string	Response content
content.user.userName	object	Name of the resource
content.attack_type	string	Type of the resource
content.date	number	Response content
content.dump_file	string	Response content
content.host	string	Response content

Output Example

Get Alert List

Return a summary list of alerts. This route is useful for displaying top level information in tables.

Endpoint

URL: /api/v2/alerts/openAlerts

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointId	string	Optional	Parameters for the Get Alert List action

Input Example

{"parameters":{"endpointId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointId	object	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.rows	array	Response content
content.rows.type	string	Type of the resource
content.rows.time	string	Response content
content.rows.info	string	Response content
content.rows.id	number	Unique identifier
content.rows.status	string	Status value
content.rows.severity	string	Response content

Output Example

Get Alerts by Time

Returns alerts for a given time period.

Endpoint

URL: /api/v2/alerts/alertsByTime

Method: POST

Input

Argument Name	Type	Required	Description
parameters.from	string	Optional	Parameters for the Get Alerts by Time action
parameters.to	string	Optional	Parameters for the Get Alerts by Time action

Input Example

{"parameters":{"from":"string","to":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.from	string	Output field: args.from
args.to	string	Output field: args.to
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.rows	array	Response content
content.rows.id	number	Unique identifier
content.rows.createdAt	string	Response content
content.rows.type	string	Type of the resource
content.rows.info	string	Response content
content.rows.status	string	Status value

Output Example

Get Alerts per Endpoint

Returns an ordered list of endpoints from most alerts to least alerts.

Endpoint

URL: /api/v2/alerts/alertsPerEndpoint

Method: POST

Input

Argument Name	Type	Required	Description
parameters.limit	integer	Optional	Parameters for the Get Alerts per Endpoint action

Input Example

{"parameters":{"limit":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.endpoints	array	Response content
content.endpoints.id	number	Unique identifier
content.endpoints.hostname	string	Name of the resource
content.endpoints.alertCount	number	Response content

Output Example

Get Endpoint Count

Returns number of endpoints for each connection status.

Endpoint

URL: /api/v2/endpoints/endpointCount

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.connected	number	Response content

Output Example

Get Endpoint Data by ID

Get a single endpoint data by ID.

Endpoint

URL: /api/v2/endpoints/post

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpoint	string	Required	Parameters for the Get Endpoint Data by ID action

Input Example

{"parameters":{"endpoint":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpoint	string	Output field: args.endpoint
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.id	number	Unique identifier
content.quarantineActive	number	Response content
content.collector	string	Response content
content.ipAddress	string	Response content
content.profile	string	Response content
content.hostname	string	Name of the resource
content.swVersion	string	Response content
content.lastCheckInAt	string	Response content
content.os	string	Response content
content.details	string	Response content
content.testing	number	Response content
content.connected	string	Response content
content.status	string	Status value
content.connectionStatus	string	Status value
content.lastQuery	string	Response content
content.alerts	array	Response content

Output Example

Get Endpoint Uptime

Returns the uptime of each individual endpoint or all endpoints by ID.

Endpoint

URL: /api/v2/endpoints/getUptime

Method: POST

Input

Argument Name	Type	Required	Description
parameters.id	string	Optional	Parameters for the Get Endpoint Uptime action

Input Example

{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.uptime	string	Response content

Output Example

Get Frontend Table Alert List

Return a summary list of alerts for the frontend table.

Endpoint

URL: /api/v2/alerts/summary

Method: POST

Input

Argument Name	Type	Required	Description
parameters.filters	string	Optional	Parameters for the Get Frontend Table Alert List action
parameters.sorters	string	Optional	Parameters for the Get Frontend Table Alert List action
parameters.offset	string	Optional	Parameters for the Get Frontend Table Alert List action
parameters.limit	string	Optional	Parameters for the Get Frontend Table Alert List action

Input Example

{"parameters":{"filters":"string","sorters":"string","offset":"string","limit":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.pageLength	string	Output field: args.pageLength
args.filters	string	Output field: args.filters
args.limitRefresh	string	Output field: args.limitRefresh
content	string	Response content

Output Example

Get Number of Alerts

Returns the number of alerts for a given type.

Endpoint

URL: /api/v2/alerts/numberOfAlerts

Method: POST

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	Parameters for the Get Number of Alerts action

Input Example

{"parameters":{"type":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.type	string	Type of the resource
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.count	number	Response content

Output Example

Get Summary Information about Protected Endpoints

Return summary level information about protected endpoints.

Endpoint

URL: /api/v2/endpoints/summary

Method: POST

Input

Argument Name	Type	Required	Description
parameters.filters	string	Optional	Parameters for the Get Summary Information about Protected Endpoints action
parameters.sorters	string	Optional	Parameters for the Get Summary Information about Protected Endpoints action
parameters.offset	string	Optional	Parameters for the Get Summary Information about Protected Endpoints action
parameters.limit	string	Optional	Parameters for the Get Summary Information about Protected Endpoints action

Input Example

{"parameters":{"filters":"string","sorters":"string","offset":"string","limit":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.pageLength	string	Output field: args.pageLength
args.filters	string	Output field: args.filters
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content
content.rows	array	Response content
content.rows.hostname	string	Name of the resource
content.rows.connectionStatus	string	Status value
content.rows.status	string	Status value
content.rows.testing	number	Response content
content.rows.connected	string	Response content
content.rows.quarantineActive	number	Response content
content.rows.ipAddress	string	Response content
content.rows.os	string	Response content
content.rows.profile	string	Response content
content.rows.id	number	Unique identifier
content.rows.swVersion	string	Response content
content.rows.collector	string	Response content
content.rows.lastCheckIn	string	Response content
content.rows.activeAlertCount	object	Response content

Output Example

Kill Alert by ID

Kills a threat on an endpoint by alert ID.

Endpoint

URL: /api/v2/alerts/killAttack

Method: POST

Input

Argument Name	Type	Required	Description
parameters.id	string	Required	Parameters for the Kill Alert by ID action

Input Example

{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.id	number	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content

Output Example

Kill Alerts

Accepts a list of alert ids and sends commands to their respective endpoints to kill threats.

Endpoint

URL: /api/v2/alerts/killAttacks

Method: POST

Input

Argument Name	Type	Required	Description
parameters.attackIds	array	Required	Parameters for the Kill Alerts action

Input Example

{"parameters":{"attackIds":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.attackIds	array	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
args.id	number	Unique identifier
content	object	Response content

Output Example

Reinstall Agent Version

Uninstalls and reinstalls the same agent version on an endpoint.

Endpoint

URL: /api/v2/endpoints/reinstallAgentVersion

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointIds	array	Required	Parameters for the Reinstall Agent Version action
parameters.token	string	Optional	Secure token which indicates ownership of installed endpoint.

Input Example

{"parameters":{"endpointIds":["string"],"token":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointIds	array	Unique identifier
args.token	string	Output field: args.token
args.limitRefresh	string	Output field: args.limitRefresh
args.query	string	Output field: args.query
content	string	Response content

Output Example

Release Alerts

Accepts a list of alert ids and sends commands to their respective endpoints to release threats.

Endpoint

URL: /api/v2/alerts/releaseAttacks

Method: POST

Input

Argument Name	Type	Required	Description
parameters.attackIds	array	Required	Parameters for the Release Alerts action

Input Example

{"parameters":{"attackIds":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.attackIds	array	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
args.id	number	Unique identifier
content	object	Response content

Output Example

Remediate Alerts

Accepts a list of alert ids and sends commands to their respective endpoints to remediate threats.

Endpoint

URL: /api/v2/alerts/remediateAttacks

Method: POST

Input

Argument Name	Type	Required	Description
parameters.attackIds	array	Required	Parameters for the Remediate Alerts action

Input Example

{"parameters":{"attackIds":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.attackIds	array	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
args.id	number	Unique identifier
content	object	Response content

Output Example

Remediate Attack by ID

Remediates a threat on an endpoint by alert ID.

Endpoint

URL: /api/v2/alerts/remediateAttack

Method: POST

Input

Argument Name	Type	Required	Description
parameters.id	string	Required	Parameters for the Remediate Attack by ID action

Input Example

{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.id	number	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	object	Response content

Output Example

Send Endpoint Query

Send a direct query to endpoints.

Endpoint

URL: /api/v2/endpoints/sendQuery

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointIds	array	Required	Parameters for the Send Endpoint Query action
parameters.query	string	Required	Parameters for the Send Endpoint Query action

Input Example

{"parameters":{"endpointIds":["string"],"query":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointIds	array	Unique identifier
args.query	string	Output field: args.query
args.limitRefresh	string	Output field: args.limitRefresh
content	string	Response content

Output Example

Test Endpoint

Send a testing mesage to the endpoint to confirm it is connected.

Endpoint

URL: /api/v2/endpoints/testEndpoint

Method: POST

Input

Argument Name	Type	Required	Description
parameters.endpointIds	array	Required	Parameters for the Test Endpoint action

Input Example

{"parameters":{"endpointIds":["string"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
code	number	Output field: code
status	string	Status value
action	string	Output field: action
args	object	Output field: args
args.endpointIds	array	Unique identifier
args.limitRefresh	string	Output field: args.limitRefresh
content	string	Response content

Output Example

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Length	The length of the response body in bytes	109
Content-Security-Policy	HTTP response header: Content-Security-Policy	default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5QviyFpjjs=';style-src 'self' 'unsafe-inline';font-src 'self' data:;upgrade-insecure-requests;base-uri 'self';form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none'
Content-Type	The media type of the resource	application/json; charset=utf-8
Cross-Origin-Embedder-Policy	HTTP response header: Cross-Origin-Embedder-Policy	require-corp
Cross-Origin-Opener-Policy	HTTP response header: Cross-Origin-Opener-Policy	same-origin
Cross-Origin-Resource-Policy	HTTP response header: Cross-Origin-Resource-Policy	same-origin
Date	The date and time at which the message was originated	Thu, 12 Oct 2023 16:08:30 GMT
ETag	An identifier for a specific version of a resource	W/"6d-iHmnyfUbA8qEvxED2UXq2dqisyI"
Expires	The date/time after which the response is considered stale	1697127810
Keep-Alive	HTTP response header: Keep-Alive	timeout=5
Origin-Agent-Cluster	HTTP response header: Origin-Agent-Cluster	?1
Referrer-Policy	HTTP response header: Referrer-Policy	no-referrer
Set-Cookie	HTTP response header: Set-Cookie	authToken=816afa7afe54817815ccd419426977dd4926aea36cf5243ba2fb93483ee266dde7e83eb8fcf182bf35467421fd915732ac144a1aeb3fec835249d7d37ad73902e4804704b1424f05348dd24b12b24985eff13348f6f06b107ec1e48d0b49a26b2678c4e154ee54c8b1a274122552c63cbfa488e77f0dee84c78f9c882641be7c; Path=/; HttpOnly; Secure
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN
X-Permitted-Cross-Domain-Policies	HTTP response header: X-Permitted-Cross-Domain-Policies	none
X-XSS-Protection	HTTP response header: X-XSS-Protection	0