--- title: Vali Cyber ZeroLock slug: connectors/vali-cyber-zerolock docTags: createdAt: 2026-06-09T16:30:08.353Z --- The ZeroLock platform addresses the entire Linux threat landscape from ransomware to cryptojacking. ZeroLock goes beyond traditional mandatory access control capabilities. In contrast to SELinux and AppArmor, ZeroLock offers easily configured and universally applied rules and policies that can be deployed across all your Linux and cloud environments from a single console. ## Prerequisites You need an `username` and `password` to authenticate the connector. ## Capabilities This connector provides the following capabilities: - Archive Endpoints - Change Agent Version - Create User - Get Alert Details by ID - Get Alert List - Get Alerts by Time - Get Alerts per Endpoint - Get Endpoint Count - Get Endpoint Data by ID - Get Endpoint Uptime - Get Frontend Table Alert List - Get Number of Alerts - Get Summary Information about Protected Endpoints - Kill Alert by ID - Kill Alerts *... and so on* ## Notes [API Documentation](https://api.zerolock.com/#/) # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Archive Endpoints Archive a list of endpoints by ID. ### Endpoint - **URL:** `/api/v2/endpoints/archiveEndpoints` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------- | | `parameters.endpointIds` | array | Required | Parameters for the Archive Endpoints action | ### Input Example `{"parameters":{"endpointIds":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointIds` | array | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Change Agent Version Uninstalls the agent and reinstalls a specified version on an endpoint. ### Endpoint - **URL:** `/api/v2/endpoints/changeAgentVersion` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------- | | `parameters.endpointIds` | array | Required | Parameters for the Change Agent Version action | | `parameters.token` | string | Required | Secure token which indicates ownership of installed endpoint. | | `parameters.version` | string | Required | Parameters for the Change Agent Version action | ### Input Example `{"parameters":{"endpointIds":["string"],"token":"string","version":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointIds` | array | Unique identifier | | `args.version` | string | Output field: args.version | | `args.token` | string | Output field: args.token | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `args.query` | string | Output field: args.query | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Create User Creates a new user. ### Endpoint - **URL:** `/api/v2/users/createUser` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------- | | `parameters.email` | string | Required | Parameters for the Create User action | | `parameters.firstname` | string | Optional | Parameters for the Create User action | | `parameters.lastname` | string | Optional | Parameters for the Create User action | | `parameters.telephone` | string | Optional | Parameters for the Create User action | | `parameters.title` | string | Optional | Parameters for the Create User action | | `parameters.roleId` | string | Optional | Parameters for the Create User action | | `parameters.SSO` | boolean | Optional | Parameters for the Create User action | | `parameters.tenantId` | string | Optional | Parameters for the Create User action | ### Input Example `{"parameters":{"email":"user@example.com","firstname":"Example Name","lastname":"Example Name","telephone":"string","title":"string","roleId":"string","SSO":true,"tenantId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Alert Details by ID Return all details for one alert by its ID. ### Endpoint - **URL:** `/api/v2/alerts/alertDetails` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Get Alert Details by ID action | ### Input Example `{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.id` | string | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.type` | string | Type of the resource | | `content.id` | number | Unique identifier | | `content.endpoint` | string | Response content | | `content.processId` | number | Unique identifier | | `content.endpointId` | number | Unique identifier | | `content.info` | string | Response content | | `content.status` | string | Status value | | `content.actionData` | object | Response data | | `content.createdAt` | string | Response content | | `content.updatedAt` | string | Response content | | `content.severity` | string | Response content | | `content.user.userName` | object | Name of the resource | | `content.attack_type` | string | Type of the resource | | `content.date` | number | Response content | | `content.dump_file` | string | Response content | | `content.host` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Alert List Return a summary list of alerts. This route is useful for displaying top level information in tables. ### Endpoint - **URL:** `/api/v2/alerts/openAlerts` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.endpointId` | string | Optional | Parameters for the Get Alert List action | ### Input Example `{"parameters":{"endpointId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointId` | object | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.rows` | array | Response content | | `content.rows.type` | string | Type of the resource | | `content.rows.time` | string | Response content | | `content.rows.info` | string | Response content | | `content.rows.id` | number | Unique identifier | | `content.rows.status` | string | Status value | | `content.rows.severity` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Alerts by Time Returns alerts for a given time period. ### Endpoint - **URL:** `/api/v2/alerts/alertsByTime` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------- | | `parameters.from` | string | Optional | Parameters for the Get Alerts by Time action | | `parameters.to` | string | Optional | Parameters for the Get Alerts by Time action | ### Input Example `{"parameters":{"from":"string","to":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.from` | string | Output field: args.from | | `args.to` | string | Output field: args.to | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.rows` | array | Response content | | `content.rows.id` | number | Unique identifier | | `content.rows.createdAt` | string | Response content | | `content.rows.type` | string | Type of the resource | | `content.rows.info` | string | Response content | | `content.rows.status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Alerts per Endpoint Returns an ordered list of endpoints from most alerts to least alerts. ### Endpoint - **URL:** `/api/v2/alerts/alertsPerEndpoint` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------------------------- | | `parameters.limit` | integer | Optional | Parameters for the Get Alerts per Endpoint action | ### Input Example `{"parameters":{"limit":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.endpoints` | array | Response content | | `content.endpoints.id` | number | Unique identifier | | `content.endpoints.hostname` | string | Name of the resource | | `content.endpoints.alertCount` | number | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Endpoint Count Returns number of endpoints for each connection status. ### Endpoint - **URL:** `/api/v2/endpoints/endpointCount` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.connected` | number | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Endpoint Data by ID Get a single endpoint data by ID. ### Endpoint - **URL:** `/api/v2/endpoints/post` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.endpoint` | string | Required | Parameters for the Get Endpoint Data by ID action | ### Input Example `{"parameters":{"endpoint":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpoint` | string | Output field: args.endpoint | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.id` | number | Unique identifier | | `content.quarantineActive` | number | Response content | | `content.collector` | string | Response content | | `content.ipAddress` | string | Response content | | `content.profile` | string | Response content | | `content.hostname` | string | Name of the resource | | `content.swVersion` | string | Response content | | `content.lastCheckInAt` | string | Response content | | `content.os` | string | Response content | | `content.details` | string | Response content | | `content.testing` | number | Response content | | `content.connected` | string | Response content | | `content.status` | string | Status value | | `content.connectionStatus` | string | Status value | | `content.lastQuery` | string | Response content | | `content.alerts` | array | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Endpoint Uptime Returns the uptime of each individual endpoint or all endpoints by ID. ### Endpoint - **URL:** `/api/v2/endpoints/getUptime` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------- | | `parameters.id` | string | Optional | Parameters for the Get Endpoint Uptime action | ### Input Example `{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.uptime` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Frontend Table Alert List Return a summary list of alerts for the frontend table. ### Endpoint - **URL:** `/api/v2/alerts/summary` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------------------- | | `parameters.filters` | string | Optional | Parameters for the Get Frontend Table Alert List action | | `parameters.sorters` | string | Optional | Parameters for the Get Frontend Table Alert List action | | `parameters.offset` | string | Optional | Parameters for the Get Frontend Table Alert List action | | `parameters.limit` | string | Optional | Parameters for the Get Frontend Table Alert List action | ### Input Example `{"parameters":{"filters":"string","sorters":"string","offset":"string","limit":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.pageLength` | string | Output field: args.pageLength | | `args.filters` | string | Output field: args.filters | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Number of Alerts Returns the number of alerts for a given type. ### Endpoint - **URL:** `/api/v2/alerts/numberOfAlerts` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.type` | string | Required | Parameters for the Get Number of Alerts action | ### Input Example `{"parameters":{"type":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.type` | string | Type of the resource | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.count` | number | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Get Summary Information about Protected Endpoints Return summary level information about protected endpoints. ### Endpoint - **URL:** `/api/v2/endpoints/summary` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `parameters.filters` | string | Optional | Parameters for the Get Summary Information about Protected Endpoints action | | `parameters.sorters` | string | Optional | Parameters for the Get Summary Information about Protected Endpoints action | | `parameters.offset` | string | Optional | Parameters for the Get Summary Information about Protected Endpoints action | | `parameters.limit` | string | Optional | Parameters for the Get Summary Information about Protected Endpoints action | ### Input Example `{"parameters":{"filters":"string","sorters":"string","offset":"string","limit":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.pageLength` | string | Output field: args.pageLength | | `args.filters` | string | Output field: args.filters | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | | `content.rows` | array | Response content | | `content.rows.hostname` | string | Name of the resource | | `content.rows.connectionStatus` | string | Status value | | `content.rows.status` | string | Status value | | `content.rows.testing` | number | Response content | | `content.rows.connected` | string | Response content | | `content.rows.quarantineActive` | number | Response content | | `content.rows.ipAddress` | string | Response content | | `content.rows.os` | string | Response content | | `content.rows.profile` | string | Response content | | `content.rows.id` | number | Unique identifier | | `content.rows.swVersion` | string | Response content | | `content.rows.collector` | string | Response content | | `content.rows.lastCheckIn` | string | Response content | | `content.rows.activeAlertCount` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Kill Alert by ID Kills a threat on an endpoint by alert ID. ### Endpoint - **URL:** `/api/v2/alerts/killAttack` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------ | | `parameters.id` | string | Required | Parameters for the Kill Alert by ID action | ### Input Example `{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.id` | number | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Kill Alerts Accepts a list of alert ids and sends commands to their respective endpoints to kill threats. ### Endpoint - **URL:** `/api/v2/alerts/killAttacks` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------- | | `parameters.attackIds` | array | Required | Parameters for the Kill Alerts action | ### Input Example `{"parameters":{"attackIds":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.attackIds` | array | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `args.id` | number | Unique identifier | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Reinstall Agent Version Uninstalls and reinstalls the same agent version on an endpoint. ### Endpoint - **URL:** `/api/v2/endpoints/reinstallAgentVersion` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------- | | `parameters.endpointIds` | array | Required | Parameters for the Reinstall Agent Version action | | `parameters.token` | string | Optional | Secure token which indicates ownership of installed endpoint. | ### Input Example `{"parameters":{"endpointIds":["string"],"token":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointIds` | array | Unique identifier | | `args.token` | string | Output field: args.token | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `args.query` | string | Output field: args.query | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Release Alerts Accepts a list of alert ids and sends commands to their respective endpoints to release threats. ### Endpoint - **URL:** `/api/v2/alerts/releaseAttacks` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.attackIds` | array | Required | Parameters for the Release Alerts action | ### Input Example `{"parameters":{"attackIds":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.attackIds` | array | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `args.id` | number | Unique identifier | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Remediate Alerts Accepts a list of alert ids and sends commands to their respective endpoints to remediate threats. ### Endpoint - **URL:** `/api/v2/alerts/remediateAttacks` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.attackIds` | array | Required | Parameters for the Remediate Alerts action | ### Input Example `{"parameters":{"attackIds":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.attackIds` | array | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `args.id` | number | Unique identifier | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Remediate Attack by ID Remediates a threat on an endpoint by alert ID. ### Endpoint - **URL:** `/api/v2/alerts/remediateAttack` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.id` | string | Required | Parameters for the Remediate Attack by ID action | ### Input Example `{"parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.id` | number | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | object | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Send Endpoint Query Send a direct query to endpoints. ### Endpoint - **URL:** `/api/v2/endpoints/sendQuery` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------- | | `parameters.endpointIds` | array | Required | Parameters for the Send Endpoint Query action | | `parameters.query` | string | Required | Parameters for the Send Endpoint Query action | ### Input Example `{"parameters":{"endpointIds":["string"],"query":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointIds` | array | Unique identifier | | `args.query` | string | Output field: args.query | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` ## Test Endpoint Send a testing mesage to the endpoint to confirm it is connected. ### Endpoint - **URL:** `/api/v2/endpoints/testEndpoint` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------- | | `parameters.endpointIds` | array | Required | Parameters for the Test Endpoint action | ### Input Example `{"parameters":{"endpointIds":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `code` | number | Output field: code | | `status` | string | Status value | | `action` | string | Output field: action | | `args` | object | Output field: args | | `args.endpointIds` | array | Unique identifier | | `args.limitRefresh` | string | Output field: args.limitRefresh | | `content` | string | Response content | ### Output Example `{"status_code":200,"response_headers":{"Content-Security-Policy":"default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5Q...","Cross-Origin-Embedder-Policy":"require-corp","Cross-Origin-Opener-Policy":"same-origin","Cross-Origin-Resource-Policy":"same-origin","X-Frame-Options":"SAMEORIGIN","Strict-Transport-Security":"max-age=15552000; includeSubDomains","X-Content-Type-Options":"nosniff","Origin-Agent-Cluster":"?1","X-Permitted-Cross-Domain-Policies":"none","Referrer-Po...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Connection | HTTP response header: Connection | keep-alive | | Content-Length | The length of the response body in bytes | 109 | | Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self';script-src 'self' 'sha256-fQwuyyUwK6AywJKiZIgaxZLfl5tW4UDBC5QviyFpjjs=';style-src 'self' 'unsafe-inline';font-src 'self' data:;upgrade-insecure-requests;base-uri 'self';form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src-attr 'none' | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Cross-Origin-Embedder-Policy | HTTP response header: Cross-Origin-Embedder-Policy | require-corp | | Cross-Origin-Opener-Policy | HTTP response header: Cross-Origin-Opener-Policy | same-origin | | Cross-Origin-Resource-Policy | HTTP response header: Cross-Origin-Resource-Policy | same-origin | | Date | The date and time at which the message was originated | Thu, 12 Oct 2023 16:08:30 GMT | | ETag | An identifier for a specific version of a resource | W/"6d-iHmnyfUbA8qEvxED2UXq2dqisyI" | | Expires | The date/time after which the response is considered stale | 1697127810 | | Keep-Alive | HTTP response header: Keep-Alive | timeout=5 | | Origin-Agent-Cluster | HTTP response header: Origin-Agent-Cluster | ?1 | | Referrer-Policy | HTTP response header: Referrer-Policy | no-referrer | | Set-Cookie | HTTP response header: Set-Cookie | authToken=816afa7afe54817815ccd419426977dd4926aea36cf5243ba2fb93483ee266dde7e83eb8fcf182bf35467421fd915732ac144a1aeb3fec835249d7d37ad73902e4804704b1424f05348dd24b12b24985eff13348f6f06b107ec1e48d0b49a26b2678c4e154ee54c8b1a274122552c63cbfa488e77f0dee84c78f9c882641be7c; Path=/; HttpOnly; Secure | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15552000; includeSubDomains | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN | | X-Permitted-Cross-Domain-Policies | HTTP response header: X-Permitted-Cross-Domain-Policies | none | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 0 |