VMWare Lastline Network

The VMWare Lastline API offers cybersecurity, vulnerability detection, and network protection services.

The VMWare Lastline network API is accessible at: https://user.lastline.com/papi/net/<function>

On-premise customers should instead access this API on their Lastline Enterprise Manager at: https://user.<MANAGER HOST NAME>/papi/net/<function>

An up-to-date version of this documentation can be browsed at Lastlines API documentation overview

Prerequisites

The VMWare Lastline API is a web-based API. To get started, you will need to request a set of credentials for accessing the API from Lastline. These credentials are a Username and a Password.

Capabilities

This plugin provides information on the following areas:

Detected URLs

Downloads

Incidents

Emails

Events

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Detected URL Stats

Endpoint

URL: papi/net/url/stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Detected URL Stats action
parameters.end_date	string	Required	Parameters for the Get Detected URL Stats action
parameters.timezone	string	Optional	Parameters for the Get Detected URL Stats action
parameters.time_scale	string	Optional	Parameters for the Get Detected URL Stats action
parameters.key	string	Optional	Parameters for the Get Detected URL Stats action
parameters.key_id	string	Optional	Parameters for the Get Detected URL Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Detected URL Stats action
parameters.detected_url_id	string	Optional	Parameters for the Get Detected URL Stats action
parameters.event_id	string	Optional	Parameters for the Get Detected URL Stats action
parameters.include_not_analyzed	string	Optional	Parameters for the Get Detected URL Stats action
parameters.task_uuid	string	Optional	Parameters for the Get Detected URL Stats action
parameters.priority	string	Optional	Parameters for the Get Detected URL Stats action
parameters.min_score	string	Optional	Parameters for the Get Detected URL Stats action
parameters.url	string	Optional	Parameters for the Get Detected URL Stats action
parameters.md5	string	Optional	Parameters for the Get Detected URL Stats action
parameters.http_host	string	Optional	Parameters for the Get Detected URL Stats action
parameters.src_ip	string	Optional	Parameters for the Get Detected URL Stats action
parameters.dst_ip	string	Optional	Parameters for the Get Detected URL Stats action
parameters.homenet	string	Optional	Parameters for the Get Detected URL Stats action
parameters.whitelisting	string	Optional	Parameters for the Get Detected URL Stats action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Detected URL Stats action

Input Example

{"parameters":{"start_date":"","end_date":"","timezone":"","time_scale":"","key":"","key_id":"","subkey_id":"","detected_url_id":"","event_id":"","include_not_analyzed":"","task_uuid":"","priority":"","min_score":"","url":"","md5":"","http_host":"","src_ip":"","dst_ip":"","homenet":"","whitelisting":"","analysis_task_typed_tags":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
priority	string	Output field: priority
start_date	string	Date value
end_date	string	Date value
total_urls	number	URL endpoint for the request
distinct_urls	number	URL endpoint for the request

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"priority":"","start_date":"","end_date":"","total_urls":1,"distinct_urls":1}}

Get Download Log Stats

Endpoint

URL: papi/net/file/download_log_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Download Log Stats action
parameters.end_time	string	Required	Parameters for the Get Download Log Stats action
parameters.timezone	string	Optional	Parameters for the Get Download Log Stats action
parameters.key	string	Optional	Parameters for the Get Download Log Stats action
parameters.key_id	string	Optional	Parameters for the Get Download Log Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Download Log Stats action
parameters.application_protocol	string	Optional	Parameters for the Get Download Log Stats action
parameters.filetype	string	Optional	Parameters for the Get Download Log Stats action
parameters.md5	string	Optional	Parameters for the Get Download Log Stats action
parameters.sha1	string	Optional	Parameters for the Get Download Log Stats action
parameters.src_ip	string	Optional	Parameters for the Get Download Log Stats action
parameters.dst_ip	string	Optional	Parameters for the Get Download Log Stats action
parameters.src_host	string	Optional	Parameters for the Get Download Log Stats action
parameters.dst_host	string	Optional	Parameters for the Get Download Log Stats action
parameters.direction	string	Optional	Parameters for the Get Download Log Stats action
parameters.submitted	string	Optional	Parameters for the Get Download Log Stats action
parameters.homenet	string	Optional	Parameters for the Get Download Log Stats action
parameters.whitelisting	string	Optional	Parameters for the Get Download Log Stats action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","application_protocol":"","filetype":"","md5":"","sha1":"","src_ip":"","dst_ip":"","src_host":"","dst_host":"","direction":"","submitted":"","homenet":"","whitelisting":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file_category	string	Output field: file_category
start_date	string	Date value
total_files	number	Output field: total_files
distinct_files	number	Output field: distinct_files

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_category":"","start_date":"","total_files":1,"distinct_files":1}}

Get Download Logs

Endpoint

URL: papi/net/file/download_logs

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Download Logs action
parameters.end_time	string	Required	Parameters for the Get Download Logs action
parameters.timezone	string	Optional	Parameters for the Get Download Logs action
parameters.key	string	Optional	Parameters for the Get Download Logs action
parameters.key_id	string	Optional	Parameters for the Get Download Logs action
parameters.subkey_id	string	Optional	Parameters for the Get Download Logs action
parameters.orderby	string	Optional	Parameters for the Get Download Logs action
parameters.max_results	string	Optional	Parameters for the Get Download Logs action
parameters.offset_results	string	Optional	Parameters for the Get Download Logs action
parameters.application_protocol	string	Optional	Parameters for the Get Download Logs action
parameters.filetype	string	Optional	Parameters for the Get Download Logs action
parameters.md5	string	Optional	Parameters for the Get Download Logs action
parameters.sha1	string	Optional	Parameters for the Get Download Logs action
parameters.task_uuid	string	Optional	Parameters for the Get Download Logs action
parameters.src_ip	string	Optional	Parameters for the Get Download Logs action
parameters.dst_ip	string	Optional	Parameters for the Get Download Logs action
parameters.src_host	string	Optional	Parameters for the Get Download Logs action
parameters.dst_host	string	Optional	Parameters for the Get Download Logs action
parameters.direction	string	Optional	Parameters for the Get Download Logs action
parameters.submitted	string	Optional	Parameters for the Get Download Logs action
parameters.homenet	string	Optional	Parameters for the Get Download Logs action
parameters.whitelisting	string	Optional	Parameters for the Get Download Logs action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","application_protocol":"","filetype":"","md5":"","sha1":"","task_uuid":"","src_ip":"","dst_ip":"","src_host":"","dst_host":"","direction":"","submitted":"","homenet":"","whitelisting":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
file_name	string	Name of the resource
file_size	string	Output field: file_size
md5	string	Output field: md5
sha1	string	Output field: sha1
raw_url	string	URL endpoint for the request
url	string	URL endpoint for the request
score	string	Score value
task_uuid	string	Unique identifier
src_host	string	Output field: src_host
src_hostname	string	Name of the resource
src_port	string	Output field: src_port
dst_host	string	Output field: dst_host
dst_port	string	Output field: dst_port
dst_hostname	string	Name of the resource
application_protocol	string	Output field: application_protocol
file_upload_status	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","raw_url":"","url":"","score":"","task_uuid":"","src_host":"","src_hostname":"","src_port":"","dst_host":""}}

Get Download Stats

Endpoint

URL: papi/net/file/download_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Download Stats action
parameters.end_time	string	Required	Parameters for the Get Download Stats action
parameters.timezone	string	Optional	Parameters for the Get Download Stats action
parameters.key	string	Optional	Parameters for the Get Download Stats action
parameters.key_id	string	Optional	Parameters for the Get Download Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Download Stats action
parameters.include_not_uploaded	string	Optional	Parameters for the Get Download Stats action
parameters.application_protocol	string	Optional	Parameters for the Get Download Stats action
parameters.md5	string	Optional	Parameters for the Get Download Stats action
parameters.task_uuid	string	Optional	Parameters for the Get Download Stats action
parameters.min_score	string	Optional	Parameters for the Get Download Stats action
parameters.src_ip	string	Optional	Parameters for the Get Download Stats action
parameters.dst_ip	string	Optional	Parameters for the Get Download Stats action
parameters.http_host	string	Optional	Parameters for the Get Download Stats action
parameters.homenet	string	Optional	Parameters for the Get Download Stats action
parameters.whitelisting	string	Optional	Parameters for the Get Download Stats action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Download Stats action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","include_not_uploaded":"","application_protocol":"","md5":"","task_uuid":"","min_score":"","src_ip":"","dst_ip":"","http_host":"","homenet":"","whitelisting":"","analysis_task_typed_tags":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file_category	string	Output field: file_category
start_date	string	Date value
total_files	number	Output field: total_files
distinct_files	number	Output field: distinct_files
max_score	string	Score value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_category":"","start_date":"","total_files":1,"distinct_files":1,"max_score":""}}

Get Downloads

Endpoint

URL: papi/net/file/downloads

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Downloads action
parameters.end_time	string	Required	Parameters for the Get Downloads action
parameters.timezone	string	Optional	Parameters for the Get Downloads action
parameters.key	string	Optional	Parameters for the Get Downloads action
parameters.key_id	string	Optional	Parameters for the Get Downloads action
parameters.subkey_id	string	Optional	Parameters for the Get Downloads action
parameters.orderby	string	Optional	Parameters for the Get Downloads action
parameters.max_results	string	Optional	Parameters for the Get Downloads action
parameters.offset_results	string	Optional	Parameters for the Get Downloads action
parameters.include_not_uploaded	string	Optional	Parameters for the Get Downloads action
parameters.application_protocol	string	Optional	Parameters for the Get Downloads action
parameters.event_id	string	Optional	Parameters for the Get Downloads action
parameters.md5	string	Optional	Parameters for the Get Downloads action
parameters.task_uuid	string	Optional	Parameters for the Get Downloads action
parameters.min_score	string	Optional	Parameters for the Get Downloads action
parameters.filetype	string	Optional	Parameters for the Get Downloads action
parameters.src_ip	string	Optional	Parameters for the Get Downloads action
parameters.src_hostname	string	Optional	Parameters for the Get Downloads action
parameters.dst_ip	string	Optional	Parameters for the Get Downloads action
parameters.http_host	string	Optional	Parameters for the Get Downloads action
parameters.homenet	string	Optional	Parameters for the Get Downloads action
parameters.whitelisting	string	Optional	Parameters for the Get Downloads action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Downloads action
parameters.include_typed_tags	string	Optional	Parameters for the Get Downloads action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","include_not_uploaded":"","application_protocol":"","event_id":"","md5":"","task_uuid":"","min_score":"","filetype":"","src_ip":"","src_hostname":"","dst_ip":"","http_host":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
file_name	string	Name of the resource
file_size	string	Output field: file_size
md5	string	Output field: md5
sha1	string	Output field: sha1
file_type	string	Type of the resource
extracted_filename	string	Name of the resource
score	string	Score value
pending	string	Output field: pending
task_uuid	string	Unique identifier
event_id	string	Unique identifier
src_host	string	Output field: src_host
src_hostname	string	Name of the resource
src_port	string	Output field: src_port
dst_host	string	Output field: dst_host
dst_port	string	Output field: dst_port
relevant_host_ip	string	Output field: relevant_host_ip
relevant_host_port	string	Output field: relevant_host_port
relevant_host_hostname	string	Name of the resource
other_host_ip	string	Output field: other_host_ip
other_host_port	string	Output field: other_host_port

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","file_type":"","extracted_filename":"","score":"","pending":"","task_uuid":"","event_id":"","src_host":"","src_hostname":"...

Get Event

Endpoint

URL: papi/net/event/get

Method: GET

Input

Argument Name	Type	Required	Description
parameters.timezone	string	Optional	Parameters for the Get Event action
parameters.event_id	string	Optional	Parameters for the Get Event action
parameters.start_time	string	Optional	Parameters for the Get Event action
parameters.end_time	string	Optional	Parameters for the Get Event action

Input Example

{"parameters":{"timezone":"","event_id":"","start_time":"","end_time":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
event_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
start_time	string	Time value
end_time	string	Time value
transport	string	Output field: transport
occurrences	number	Output field: occurrences
blocked	boolean	Output field: blocked
relevant_host_ip	string	Output field: relevant_host_ip
other_host_ip	string	Output field: other_host_ip
server_port	string	Output field: server_port
relevant_host_hostname	string	Name of the resource
other_host_hostname	string	Name of the resource
src_id	string	Unique identifier
host_label	string	Output field: host_label
host_whitelisted	boolean	Output field: host_whitelisted
src_mac	string	Output field: src_mac
event_type_id	string	Unique identifier
event_type	string	Type of the resource
threat	string	Output field: threat
threat_class	string	Output field: threat_class
impact	string	Output field: impact

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"event_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"23/01/2023","end_time":"23/01/2023","transport":"","occurrences":1,"blocked":true,"relevant_host_ip":"","other_host_ip":"","...

Get Event Attributes

Endpoint

URL: papi/net/event/attributes

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Required	Parameters for the Get Event Attributes action
parameters.event_time	string	Required	Parameters for the Get Event Attributes action
parameters.key	string	Optional	Parameters for the Get Event Attributes action
parameters.key_id	string	Optional	Parameters for the Get Event Attributes action
parameters.subkey_id	string	Optional	Parameters for the Get Event Attributes action
parameters.customer	string	Optional	Parameters for the Get Event Attributes action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
name	string	Name of the resource
value	string	Value for the parameter

Output Example

Get Event Blacklist Match Info

Endpoint

URL: papi/net/event/blacklist_match

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Required	Parameters for the Get Event Blacklist Match Info action
parameters.event_time	string	Required	Parameters for the Get Event Blacklist Match Info action
parameters.key	string	Optional	Parameters for the Get Event Blacklist Match Info action
parameters.key_id	string	Optional	Parameters for the Get Event Blacklist Match Info action
parameters.subkey_id	string	Optional	Parameters for the Get Event Blacklist Match Info action
parameters.customer	string	Optional	Parameters for the Get Event Blacklist Match Info action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
domain	string	Output field: domain
ip	string	Output field: ip
url_path	string	URL endpoint for the request
port	string	Output field: port
is_local_blacklist	string	Output field: is_local_blacklist

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"domain":"","ip":"","url_path":"","port":"","is_local_blacklist":""}}

Get Event Evidence

Endpoint

URL: papi/net/event/evidence

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Required	Parameters for the Get Event Evidence action
parameters.event_time	string	Required	Parameters for the Get Event Evidence action
parameters.key	string	Optional	Parameters for the Get Event Evidence action
parameters.key_id	string	Optional	Parameters for the Get Event Evidence action
parameters.subkey_id	string	Optional	Parameters for the Get Event Evidence action
parameters.customer	string	Optional	Parameters for the Get Event Evidence action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threat	string	Output field: threat
threat_class	string	Output field: threat_class
confidence	string	Unique identifier
severity	string	Output field: severity
impact	string	Output field: impact
evidence_type	string	Unique identifier
detector	string	Output field: detector
activity	string	Output field: activity
subject	string	Output field: subject
signature_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"threat":"","threat_class":"","confidence":"","severity":"","impact":"","evidence_type":"","detector":"","activity":"","subject":"","signature_id":""}}

Get Event Network IOCs

Endpoint

URL: papi/net/event/network_iocs

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Required	Parameters for the Get Event Network IOCs action
parameters.event_time	string	Required	Parameters for the Get Event Network IOCs action
parameters.key	string	Optional	Parameters for the Get Event Network IOCs action
parameters.key_id	string	Optional	Parameters for the Get Event Network IOCs action
parameters.subkey_id	string	Optional	Parameters for the Get Event Network IOCs action
parameters.customer	string	Optional	Parameters for the Get Event Network IOCs action
parameters.limit	number	Optional	Parameters for the Get Event Network IOCs action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":"","limit":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
task_uuid	string	Unique identifier
score	string	Score value
domain	string	Output field: domain
ip	string	Output field: ip
url_path	string	URL endpoint for the request
port	string	Output field: port
detector	string	Output field: detector
threat	string	Output field: threat
impact	string	Output field: impact

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"task_uuid":"","score":"","domain":"","ip":"","url_path":"","port":"","detector":"","threat":"","impact":""}}

Get Incident

Endpoint

URL: papi/net/incident/get

Method: GET

Input

Argument Name	Type	Required	Description
parameters.incident_id	string	Required	Parameters for the Get Incident action
parameters.timezone	string	Optional	Parameters for the Get Incident action

Input Example

{"parameters":{"incident_id":"","timezone":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
incident_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
start_time	string	Time value
end_time	string	Time value
events	number	Output field: events
src_host	string	Output field: src_host
num_src_ips	number	Output field: num_src_ips
src_hostname	string	Name of the resource
blocked	string	Output field: blocked
src_id	string	Unique identifier
src_label	string	Output field: src_label
host_label	string	Output field: host_label
host_whitelisted	string	Output field: host_whitelisted
threat	string	Output field: threat
threat_class	string	Output field: threat_class
impact	string	Output field: impact
is_archived	string	Output field: is_archived
is_read	string	Output field: is_read
archived_cause	string	Output field: archived_cause
comment	string	Output field: comment
mitigation	string	Output field: mitigation

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","access_key_id":"","subkey_id":"","time":"","start_time":"","end_time":"","events":1,"src_host":"","num_src_ips":1,"src_hostname":"","blocked":"","src_id":"","src_label":"","host_label":"","host_whi...

Get Incident Evidence

Endpoint

URL: papi/net/incident/evidence

Method: GET

Input

Argument Name	Type	Required	Description
parameters.incident_id	string	Required	Parameters for the Get Incident Evidence action
parameters.key	string	Optional	Parameters for the Get Incident Evidence action
parameters.key_id	string	Optional	Parameters for the Get Incident Evidence action
parameters.subkey_id	string	Optional	Parameters for the Get Incident Evidence action
parameters.customer	string	Optional	Parameters for the Get Incident Evidence action
parameters.timezone	string	Optional	Parameters for the Get Incident Evidence action
parameters.extended	boolean	Optional	Parameters for the Get Incident Evidence action

Input Example

{"parameters":{"incident_id":"","key":"","key_id":"","subkey_id":"","customer":"","timezone":"","extended":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
threat	string	Output field: threat
threat_class	string	Output field: threat_class
confidence	string	Unique identifier
severity	string	Output field: severity
impact	string	Output field: impact
evidence_type	string	Unique identifier
detector	string	Output field: detector
activity	string	Output field: activity
subject	string	Output field: subject
first_seen	string	Output field: first_seen
last_seen	string	Output field: last_seen
reference_type	string	Type of the resource
reference_id	string	Unique identifier
reference_time	string	Time value
reference_event	string	Output field: reference_event
URLs	string	URL endpoint for the request
blacklist_match_info	string	Output field: blacklist_match_info
dga_domains	string	Output field: dga_domains
dga_domain_count	number	Count value
download_file_type	string	Type of the resource
download_file_name	string	Name of the resource
llanta_rule_name	string	Name of the resource
detector_goal	string	Output field: detector_goal

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"threat":"","threat_class":"","confidence":"","severity":"","impact":"","evidence_type":"","detector":"","activity":"","subject":"","first_seen":"","last_seen":"","reference_type":"","reference_id":"","reference_tim...

Get Incident Stats

Endpoint

URL: papi/net/file/incident_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Incident Stats action
parameters.end_date	string	Required	Parameters for the Get Incident Stats action
parameters.time_scale	string	Required	Parameters for the Get Incident Stats action
parameters.timezone	string	Optional	Parameters for the Get Incident Stats action
parameters.key	string	Optional	Parameters for the Get Incident Stats action
parameters.key_id	string	Optional	Parameters for the Get Incident Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Incident Stats action
parameters.group_by_impact	string	Optional	Parameters for the Get Incident Stats action
parameters.priority	string	Optional	Parameters for the Get Incident Stats action
parameters.threat_class	string	Optional	Parameters for the Get Incident Stats action
parameters.threat	string	Optional	Parameters for the Get Incident Stats action
parameters.src_id	string	Optional	Parameters for the Get Incident Stats action
parameters.src_ip	string	Optional	Parameters for the Get Incident Stats action
parameters.src_hostname	string	Optional	Parameters for the Get Incident Stats action
parameters.archived	string	Optional	Parameters for the Get Incident Stats action
parameters.read	string	Optional	Parameters for the Get Incident Stats action
parameters.whitelisting	string	Optional	Parameters for the Get Incident Stats action
parameters.homenet	string	Optional	Parameters for the Get Incident Stats action
parameters.breach_uuid	string	Optional	Parameters for the Get Incident Stats action
parameters.host_tag	string	Optional	Parameters for the Get Incident Stats action
parameters.incidents_older_than	string	Optional	Parameters for the Get Incident Stats action

Input Example

{"parameters":{"start_date":"","end_date":"","time_scale":"","timezone":"","key":"","key_id":"","subkey_id":"","group_by_impact":"","priority":"","threat_class":"","threat":"","src_id":"","src_ip":"","src_hostname":"","archived":"","read":"","whitelisting":"","homenet":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
max_impact	string	Output field: max_impact
incidents	number	Unique identifier
events	number	Output field: events
sources	number	Output field: sources
priority	string	Output field: priority
start_date	string	Date value
end_date	string	Date value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"max_impact":"","incidents":1,"events":1,"sources":1,"priority":"","start_date":"","end_date":""}}

Get Mail Attachment Stats

Endpoint

URL: papi/net/mail/attachment_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Mail Attachment Stats action
parameters.end_date	string	Required	Parameters for the Get Mail Attachment Stats action
parameters.timezone	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.key	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.key_id	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.recipient	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.subject	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.sender	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.min_score	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.md5	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.task_uuid	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.action	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.message_action	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.content_action	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Attachment Stats action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Attachment Stats action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail Attachment Stats action

Input Example

{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file_type	string	Type of the resource
start_date	string	Date value
total_files	number	Output field: total_files
distinct_files	number	Output field: distinct_files
max_score	string	Score value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_type":"","start_date":"","total_files":1,"distinct_files":1,"max_score":""}}

Get Mail Attachments

Endpoint

URL: papi/net/mail/attachments

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Attachments action
parameters.end_time	string	Required	Parameters for the Get Mail Attachments action
parameters.timezone	string	Optional	Parameters for the Get Mail Attachments action
parameters.key	string	Optional	Parameters for the Get Mail Attachments action
parameters.key_id	string	Optional	Parameters for the Get Mail Attachments action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Attachments action
parameters.orderby	string	Optional	Parameters for the Get Mail Attachments action
parameters.max_results	string	Optional	Parameters for the Get Mail Attachments action
parameters.offset_results	string	Optional	Parameters for the Get Mail Attachments action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Attachments action
parameters.recipient	string	Optional	Parameters for the Get Mail Attachments action
parameters.subject	string	Optional	Parameters for the Get Mail Attachments action
parameters.sender	string	Optional	Parameters for the Get Mail Attachments action
parameters.min_score	string	Optional	Parameters for the Get Mail Attachments action
parameters.md5	string	Optional	Parameters for the Get Mail Attachments action
parameters.task_uuid	string	Optional	Parameters for the Get Mail Attachments action
parameters.action	string	Optional	Parameters for the Get Mail Attachments action
parameters.message_action	string	Optional	Parameters for the Get Mail Attachments action
parameters.content_action	string	Optional	Parameters for the Get Mail Attachments action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Attachments action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Attachments action
parameters.include_typed_tags	string	Optional	Parameters for the Get Mail Attachments action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Attachments action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Attachments action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Attachments action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","include_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
file_name	string	Name of the resource
file_type	string	Type of the resource
file_size	string	Output field: file_size
md5	string	Output field: md5
sha1	string	Output field: sha1
task_uuid	string	Unique identifier
score	string	Score value
llfiletype	string	Type of the resource
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
action	string	Output field: action
message_action	string	Response message
typed_tags	string	Type of the resource
appliance_uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","time":"","message_id":"","timestamp":"","file_name":"","file_type":"","file_size":"","md5":"","sha1":"","task_uuid":"","score":"","llfiletype":"","sender":"","recipient":""}}

Get Mail Delivery Log

Endpoint

URL: papi/net/mail/mail_delivery_log

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Delivery Log action
parameters.end_time	string	Required	Parameters for the Get Mail Delivery Log action
parameters.timezone	string	Optional	Parameters for the Get Mail Delivery Log action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Delivery Log action
parameters.mail_message_log_id	string	Optional	Parameters for the Get Mail Delivery Log action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_delivery_outcome	string	Output field: mail_delivery_outcome
delivery_timestamp	string	Output field: delivery_timestamp
details	string	Output field: details
host	string	Output field: host

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_delivery_outcome":"","delivery_timestamp":"","details":"","host":""}}

Get Mail Detections

Endpoint

URL: papi/net/mail/detections

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Detections action
parameters.end_time	string	Required	Parameters for the Get Mail Detections action
parameters.timezone	string	Optional	Parameters for the Get Mail Detections action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Detections action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
detector	string	Output field: detector
action	string	Output field: action
threat	string	Output field: threat
threat_class	string	Output field: threat_class

Output Example

Get Mail Message

Endpoint

URL: papi/net/mail/messages

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Message action
parameters.end_time	string	Required	Parameters for the Get Mail Message action
parameters.timezone	string	Optional	Parameters for the Get Mail Message action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Message action
parameters.include_typed_tags	string	Optional	Parameters for the Get Mail Message action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","include_typed_tags":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
subkey_id	string	Unique identifier
date	string	Date value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
size	string	Output field: size
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
threat	string	Output field: threat
threat_class	string	Output field: threat_class
attachments	number	Output field: attachments
URLs	number	URL endpoint for the request
impact	string	Output field: impact
relevant_content	string	Response content
message_action	string	Response message
content_action	string	Response content
breach_uuid	string	Unique identifier
assigned_to	string	Output field: assigned_to
mail_state	string	Output field: mail_state
typed_tags	string	Type of the resource
mail_processing_state	string	Output field: mail_processing_state
mail_analysis_status	string	Status value

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","date":"","message_id":"","timestamp":"","size":"","sender":"","recipient":"","subject":"","threat":"","threat_class":"","attachments":1,"URLs":1,"impact":"","relevant_content":""...

Get Mail Message Headers

Endpoint

URL: papi/net/mail/mail_message_headers

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Message Headers action
parameters.end_time	string	Required	Parameters for the Get Mail Message Headers action
parameters.timezone	string	Optional	Parameters for the Get Mail Message Headers action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Message Headers action
parameters.mail_message_log_id	string	Optional	Parameters for the Get Mail Message Headers action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
header_field_name	string	Name of the resource
header_field_body	string	Request body data

Output Example

Get Mail Messages

Endpoint

URL: papi/net/mail/messages

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Messages action
parameters.end_time	string	Required	Parameters for the Get Mail Messages action
parameters.timezone	string	Optional	Parameters for the Get Mail Messages action
parameters.key	string	Optional	Parameters for the Get Mail Messages action
parameters.key_id	string	Optional	Parameters for the Get Mail Messages action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Messages action
parameters.orderby	string	Optional	Parameters for the Get Mail Messages action
parameters.max_results	string	Optional	Parameters for the Get Mail Messages action
parameters.offset_results	string	Optional	Parameters for the Get Mail Messages action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Messages action
parameters.recipient	string	Optional	Parameters for the Get Mail Messages action
parameters.subject	string	Optional	Parameters for the Get Mail Messages action
parameters.sender	string	Optional	Parameters for the Get Mail Messages action
parameters.min_score	string	Optional	Parameters for the Get Mail Messages action
parameters.md5	string	Optional	Parameters for the Get Mail Messages action
parameters.task_uuid	string	Optional	Parameters for the Get Mail Messages action
parameters.action	string	Optional	Parameters for the Get Mail Messages action
parameters.message_action	string	Optional	Parameters for the Get Mail Messages action
parameters.content_action	string	Optional	Parameters for the Get Mail Messages action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Messages action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Messages action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Messages action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Messages action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Messages action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail Messages action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
subkey_id	string	Unique identifier
date	string	Date value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
size	string	Output field: size
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
threat	string	Output field: threat
threat_class	string	Output field: threat_class
attachments	number	Output field: attachments
URLs	number	URL endpoint for the request
impact	string	Output field: impact
relevant_content	string	Response content
message_action	string	Response message
content_action	string	Response content
assigned_to	string	Output field: assigned_to
mail_state	string	Output field: mail_state
typed_tags	string	Type of the resource
mail_processing_state	string	Output field: mail_processing_state
mail_analysis_status	string	Status value
mail_delivery_outcome	string	Output field: mail_delivery_outcome

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","date":"","message_id":"","timestamp":"","size":"","sender":"","recipient":"","subject":"","threat":"","threat_class":"","attachments":1,"URLs":1,"impact":"","relevant_content":""...

Get Mail Messages Malware

Endpoint

URL: papi/net/mail/messages_malware

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Mail Messages Malware action
parameters.end_date	string	Required	Parameters for the Get Mail Messages Malware action
parameters.timezone	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.key	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.key_id	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.recipient	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.subject	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.sender	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.relevant_content	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.min_impact	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.priority	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.threat	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.threat_class	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.message_action	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.content_action	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Messages Malware action
parameters.assigned_to	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.mail_state	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Messages Malware action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail Messages Malware action

Input Example

{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","recipient":"","subject":"","sender":"","relevant_content":"","min_impact":"","priority":"","threat":"","threat_class":"","message_action":"","content_action":"","blocked":true,"assigned_to":"","mail_state":"","analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start_time	string	Time value
end_time	string	Time value
max_impact	string	Output field: max_impact
occurrences	number	Output field: occurrences
threat	string	Output field: threat
threat_class	string	Output field: threat_class
priority	string	Output field: priority

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_time":"","end_time":"","max_impact":"","occurrences":1,"threat":"","threat_class":"","priority":""}}

Get Mail Messages Malware Priority

Endpoint

URL: papi/net/mail/messages_malware_priority

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Mail Messages Malware Priority action
parameters.end_date	string	Required	Parameters for the Get Mail Messages Malware Priority action
parameters.timezone	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.key	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.key_id	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.recipient	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.subject	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.sender	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.relevant_content	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.min_impact	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.priority	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.threat	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.threat_class	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.message_action	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.content_action	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.assigned_to	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.mail_state	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Messages Malware Priority action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail Messages Malware Priority action

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

Get Mail Messages Stats

Endpoint

URL: papi/net/mail/messages_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Mail Messages Stats action
parameters.end_date	string	Required	Parameters for the Get Mail Messages Stats action
parameters.timezone	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.time_scale	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.key	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.key_id	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.group_by_priority	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.recipient	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.subject	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.sender	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.relevant_content	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.min_impact	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.priority	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.threat	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.threat_class	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.message_action	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.content_action	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.blocked	boolean	Optional	Parameters for the Get Mail Messages Stats action
parameters.assigned_to	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.mail_state	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail Messages Stats action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail Messages Stats action

Input Example

{"parameters":{"start_date":"","end_date":"","timezone":"","time_scale":"","key":"","key_id":"","subkey_id":"","group_by_priority":"","recipient":"","subject":"","sender":"","relevant_content":"","min_impact":"","priority":"","threat":"","threat_class":"","message_action":"","content_action":"","blocked":true,"assigned_to":"","mail_state":"","analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start_date	string	Date value
end_date	string	Date value
max_impact	string	Output field: max_impact
occurrences	number	Output field: occurrences
priority	string	Output field: priority

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_date":"","end_date":"","max_impact":"","occurrences":1,"priority":""}}

Get Mail Processing Log

Endpoint

URL: papi/net/mail/mail_processing_log

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail Processing Log action
parameters.end_time	string	Required	Parameters for the Get Mail Processing Log action
parameters.timezone	string	Optional	Parameters for the Get Mail Processing Log action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail Processing Log action
parameters.mail_message_log_id	string	Optional	Parameters for the Get Mail Processing Log action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
state	string	Output field: state
timestamp	string	Output field: timestamp

Output Example

Get Mail URL Stats

Endpoint

URL: papi/net/mail/url_stats

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Mail URL Stats action
parameters.end_date	string	Required	Parameters for the Get Mail URL Stats action
parameters.timezone	string	Optional	Parameters for the Get Mail URL Stats action
parameters.key	string	Optional	Parameters for the Get Mail URL Stats action
parameters.key_id	string	Optional	Parameters for the Get Mail URL Stats action
parameters.subkey_id	string	Optional	Parameters for the Get Mail URL Stats action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail URL Stats action
parameters.recipient	string	Optional	Parameters for the Get Mail URL Stats action
parameters.subject	string	Optional	Parameters for the Get Mail URL Stats action
parameters.sender	string	Optional	Parameters for the Get Mail URL Stats action
parameters.min_score	string	Optional	Parameters for the Get Mail URL Stats action
parameters.md5	string	Optional	Parameters for the Get Mail URL Stats action
parameters.task_uuid	string	Optional	Parameters for the Get Mail URL Stats action
parameters.action	string	Optional	Parameters for the Get Mail URL Stats action
parameters.message_action	string	Optional	Parameters for the Get Mail URL Stats action
parameters.content_action	string	Optional	Parameters for the Get Mail URL Stats action
parameters.blocked	boolean	Optional	Parameters for the Get Mail URL Stats action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail URL Stats action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail URL Stats action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail URL Stats action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail URL Stats action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail URL Stats action

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start_date	string	Date value
total_urls	number	URL endpoint for the request
distinct_url	number	URL endpoint for the request
max_score	string	Score value

Output Example

Get Mail URLs

Endpoint

URL: papi/net/mail/urls

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Mail URLs action
parameters.end_time	string	Required	Parameters for the Get Mail URLs action
parameters.timezone	string	Optional	Parameters for the Get Mail URLs action
parameters.key	string	Optional	Parameters for the Get Mail URLs action
parameters.key_id	string	Optional	Parameters for the Get Mail URLs action
parameters.subkey_id	string	Optional	Parameters for the Get Mail URLs action
parameters.orderby	string	Optional	Parameters for the Get Mail URLs action
parameters.max_results	string	Optional	Parameters for the Get Mail URLs action
parameters.offset_results	string	Optional	Parameters for the Get Mail URLs action
parameters.mail_message_id	string	Optional	Parameters for the Get Mail URLs action
parameters.recipient	string	Optional	Parameters for the Get Mail URLs action
parameters.subject	string	Optional	Parameters for the Get Mail URLs action
parameters.sender	string	Optional	Parameters for the Get Mail URLs action
parameters.min_score	string	Optional	Parameters for the Get Mail URLs action
parameters.md5	string	Optional	Parameters for the Get Mail URLs action
parameters.task_uuid	string	Optional	Parameters for the Get Mail URLs action
parameters.action	string	Optional	Parameters for the Get Mail URLs action
parameters.message_action	string	Optional	Parameters for the Get Mail URLs action
parameters.content_action	string	Optional	Parameters for the Get Mail URLs action
parameters.blocked	boolean	Optional	Parameters for the Get Mail URLs action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Mail URLs action
parameters.mail_processing_state	string	Optional	Parameters for the Get Mail URLs action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Mail URLs action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Mail URLs action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Mail URLs action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
date	string	Date value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
url	string	URL endpoint for the request
raw_url	string	URL endpoint for the request
md5	string	Output field: md5
task_uuid	string	Unique identifier
score	string	Score value
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
action	string	Output field: action
message_action	string	Response message
typed_tags	string	Type of the resource
appliance_uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","access_key_id":"","subkey_id":"","time":"","date":"","message_id":"","timestamp":"","url":"","raw_url":"","md5":"","task_uuid":"","score":"","sender":"","recipient":"","subject":""}}

Get Malware

Endpoint

URL: papi/net/incident/malware

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_date	string	Required	Parameters for the Get Malware action
parameters.end_date	string	Required	Parameters for the Get Malware action
parameters.timezone	string	Optional	Parameters for the Get Malware action
parameters.key	string	Optional	Parameters for the Get Malware action
parameters.key_id	string	Optional	Parameters for the Get Malware action
parameters.subkey_id	string	Optional	Parameters for the Get Malware action
parameters.split_by_priority	string	Optional	Parameters for the Get Malware action
parameters.whitelisting	string	Optional	Parameters for the Get Malware action
parameters.homenet	string	Optional	Parameters for the Get Malware action
parameters.archived	string	Optional	Parameters for the Get Malware action
parameters.read	string	Optional	Parameters for the Get Malware action
parameters.src_ip	string	Optional	Parameters for the Get Malware action
parameters.src_hostname	string	Optional	Parameters for the Get Malware action
parameters.breach_uuid	string	Optional	Parameters for the Get Malware action
parameters.host_tag	string	Optional	Parameters for the Get Malware action
parameters.incidents_older_than	string	Optional	Parameters for the Get Malware action

Input Example

{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","split_by_priority":"","whitelisting":"","homenet":"","archived":"","read":"","src_ip":"","src_hostname":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
start_time	string	Time value
end_time	string	Time value
max_impact	string	Output field: max_impact
incidents	number	Unique identifier
events	number	Output field: events
sources	number	Output field: sources
threat	string	Output field: threat
threat_class	string	Output field: threat_class
priority	string	Output field: priority

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_time":"","end_time":"","max_impact":"","incidents":1,"events":1,"sources":1,"threat":"","threat_class":"","priority":""}}

Get Similar Event Filters

Endpoint

URL: papi/net/event/similar_events_filters/get

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Required	Parameters for the Get Similar Event Filters action
parameters.event_time	string	Required	Parameters for the Get Similar Event Filters action
parameters.key	string	Optional	Parameters for the Get Similar Event Filters action
parameters.key_id	string	Optional	Parameters for the Get Similar Event Filters action
parameters.subkey_id	string	Optional	Parameters for the Get Similar Event Filters action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
relevant_host_ip	string	Output field: relevant_host_ip
other_host_ip	string	Output field: other_host_ip
server_port	string	Output field: server_port
other_host_hostname	string	Name of the resource
transport_protocol	string	Output field: transport_protocol
relevant_host_in_homenet	string	Output field: relevant_host_in_homenet
other_host_in_homenet	string	Output field: other_host_in_homenet
relevant_host_whitelisted	string	Output field: relevant_host_whitelisted
detector	string	Output field: detector
threat	string	Output field: threat
threat_class	string	Output field: threat_class
event_outcome	string	Output field: event_outcome
event_type	string	Type of the resource
file_category	string	Output field: file_category
file_type	string	Type of the resource
av_class	string	Output field: av_class
malware	string	Output field: malware
llanta_rule_uuid	string	Unique identifier
custom_ids_rule_id	string	Unique identifier
relevant_host_tags	string	Output field: relevant_host_tags
other_host_tags	string	Output field: other_host_tags

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"relevant_host_ip":"","other_host_ip":"","server_port":"","other_host_hostname":"","transport_protocol":"","relevant_host_in_homenet":"","other_host_in_homenet":"","relevant_host_whitelisted":"","detector":"","threa...

Get Source Incident Evidence

Endpoint

URL: papi/net/incident/host_evidence

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Source Incident Evidence action
parameters.end_time	string	Required	Parameters for the Get Source Incident Evidence action
parameters.src_ip	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.key	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.key_id	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.subkey_id	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.customer	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.timezone	string	Optional	Parameters for the Get Source Incident Evidence action
parameters.extended	boolean	Optional	Parameters for the Get Source Incident Evidence action

Input Example

{"parameters":{"start_time":"","end_time":"","src_ip":"","key":"","key_id":"","subkey_id":"","customer":"","timezone":"","extended":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
incident_id	string	Unique identifier
reference_event	string	Output field: reference_event
URLs	string	URL endpoint for the request
blacklist_match_info	string	Output field: blacklist_match_info
dga_domains	string	Output field: dga_domains
dga_domain_count	number	Count value
download_file_type	string	Type of the resource
download_file_name	string	Name of the resource
llanta_rule_name	string	Name of the resource
detector_goal	string	Output field: detector_goal

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","reference_event":"","URLs":"","blacklist_match_info":"","dga_domains":"","dga_domain_count":1,"download_file_type":"","download_file_name":"","llanta_rule_name":"","detector_goal":""}}

Get Unique Detected URLs

Endpoint

URL: papi/net/url/unique

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Unique Detected URLs action
parameters.end_time	string	Required	Parameters for the Get Unique Detected URLs action
parameters.timezone	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.key	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.key_id	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.subkey_id	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.orderby	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.max_results	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.offset_results	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.detected_url_id	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.event_id	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.include_not_analyzed	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.task_uuid	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.priority	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.min_score	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.url	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.md5	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.http_host	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.src_ip	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.dst_ip	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.homenet	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.whitelisting	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Unique Detected URLs action
parameters.include_typed_tags	string	Optional	Parameters for the Get Unique Detected URLs action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","detected_url_id":"","event_id":"","include_not_analyzed":"","task_uuid":"","priority":"","min_score":"","url":"","md5":"","http_host":"","src_ip":"","dst_ip":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request
md5	string	Output field: md5
num_requests	number	Output field: num_requests
num_sensors	number	Output field: num_sensors
first_seen	string	Output field: first_seen
last_seen	string	Output field: last_seen
score	string	Score value
pending	string	Output field: pending
task_uuid	string	Unique identifier
src_ip	string	Output field: src_ip
dst_ip	string	Output field: dst_ip
num_source_ips	number	Output field: num_source_ips
num_dst_ips	number	Output field: num_dst_ips
http_host	string	Output field: http_host
num_http_host	number	Output field: num_http_host
typed_tags	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"url":"","md5":"","num_requests":1,"num_sensors":1,"first_seen":"","last_seen":"","score":"","pending":"","task_uuid":"","src_ip":"","dst_ip":"","num_source_ips":1,"num_dst_ips":1,"http_host":"","num_http_host":1}}

Get Unique Downloads

Endpoint

URL: papi/net/file/unique_downloads

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Unique Downloads action
parameters.end_time	string	Required	Parameters for the Get Unique Downloads action
parameters.timezone	string	Optional	Parameters for the Get Unique Downloads action
parameters.key	string	Optional	Parameters for the Get Unique Downloads action
parameters.key_id	string	Optional	Parameters for the Get Unique Downloads action
parameters.subkey_id	string	Optional	Parameters for the Get Unique Downloads action
parameters.orderby	string	Optional	Parameters for the Get Unique Downloads action
parameters.max_results	string	Optional	Parameters for the Get Unique Downloads action
parameters.offset_results	string	Optional	Parameters for the Get Unique Downloads action
parameters.include_not_uploaded	string	Optional	Parameters for the Get Unique Downloads action
parameters.application_protocol	string	Optional	Parameters for the Get Unique Downloads action
parameters.event_id	string	Optional	Parameters for the Get Unique Downloads action
parameters.md5	string	Optional	Parameters for the Get Unique Downloads action
parameters.task_uuid	string	Optional	Parameters for the Get Unique Downloads action
parameters.min_score	string	Optional	Parameters for the Get Unique Downloads action
parameters.filetype	string	Optional	Parameters for the Get Unique Downloads action
parameters.src_ip	string	Optional	Parameters for the Get Unique Downloads action
parameters.src_hostname	string	Optional	Parameters for the Get Unique Downloads action
parameters.dst_ip	string	Optional	Parameters for the Get Unique Downloads action
parameters.http_host	string	Optional	Parameters for the Get Unique Downloads action
parameters.homenet	string	Optional	Parameters for the Get Unique Downloads action
parameters.whitelisting	string	Optional	Parameters for the Get Unique Downloads action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Unique Downloads action
parameters.include_typed_tags	string	Optional	Parameters for the Get Unique Downloads action

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
file_name	string	Name of the resource
file_size	string	Output field: file_size
md5	string	Output field: md5
sha1	string	Output field: sha1
file_type	string	Type of the resource
extracted_filename	string	Name of the resource
score	string	Score value
pending	string	Output field: pending
task_uuid	string	Unique identifier
event_id	string	Unique identifier
src_host	string	Output field: src_host
src_hostname	string	Name of the resource
src_port	string	Output field: src_port
dst_host	string	Output field: dst_host
dst_port	string	Output field: dst_port
relevant_host_ip	string	Output field: relevant_host_ip
relevant_host_port	string	Output field: relevant_host_port
relevant_host_hostname	string	Name of the resource
other_host_ip	string	Output field: other_host_ip
other_host_port	string	Output field: other_host_port

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","file_type":"","extracted_filename":"","score":"","pending":"","task_uuid":"","event_id":"","src_host":"","src_hostname":"...

Get Unique Mail Attachments

Endpoint

URL: papi/net/mail/unique_attachments

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Unique Mail Attachments action
parameters.end_time	string	Required	Parameters for the Get Unique Mail Attachments action
parameters.timezone	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.key	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.key_id	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.subkey_id	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.orderby	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.max_results	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.offset_results	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.mail_message_id	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.recipient	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.subject	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.sender	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.min_score	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.md5	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.task_uuid	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.action	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.message_action	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.content_action	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.blocked	boolean	Optional	Parameters for the Get Unique Mail Attachments action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.include_typed_tags	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.mail_processing_state	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Unique Mail Attachments action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Unique Mail Attachments action

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
file_name	string	Name of the resource
file_type	string	Type of the resource
file_size	string	Output field: file_size
md5	string	Output field: md5
sha1	string	Output field: sha1
task_uuid	string	Unique identifier
score	string	Score value
llfiletype	string	Type of the resource
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
action	string	Output field: action
message_action	string	Response message
typed_tags	string	Type of the resource
appliance_uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","time":"","message_id":"","timestamp":"","file_name":"","file_type":"","file_size":"","md5":"","sha1":"","task_uuid":"","score":"","llfiletype":"","sender":"","recipient":""}}

Get Unique Mail URLs

Endpoint

URL: papi/net/mail/unique_urls

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get Unique Mail URLs action
parameters.end_time	string	Required	Parameters for the Get Unique Mail URLs action
parameters.timezone	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.key	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.key_id	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.subkey_id	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.orderby	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.max_results	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.offset_results	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.mail_message_id	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.recipient	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.subject	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.sender	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.min_score	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.md5	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.task_uuid	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.action	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.message_action	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.content_action	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.blocked	boolean	Optional	Parameters for the Get Unique Mail URLs action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.mail_processing_state	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.mail_analysis_status	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.mail_delivery_outcome	string	Optional	Parameters for the Get Unique Mail URLs action
parameters.lastline_mail_uuid	string	Optional	Parameters for the Get Unique Mail URLs action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
mail_message_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
date	string	Date value
message_id	string	Unique identifier
timestamp	string	Output field: timestamp
url	string	URL endpoint for the request
raw_url	string	URL endpoint for the request
md5	string	Output field: md5
task_uuid	string	Unique identifier
score	string	Score value
sender	string	Output field: sender
recipient	string	Output field: recipient
subject	string	Output field: subject
action	string	Output field: action
message_action	string	Response message
typed_tags	string	Type of the resource
appliance_uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","access_key_id":"","subkey_id":"","time":"","date":"","message_id":"","timestamp":"","url":"","raw_url":"","md5":"","task_uuid":"","score":"","sender":"","recipient":"","subject":""}}

Get URL Detections

Endpoint

URL: papi/net/url/all

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the Get URL Detections action
parameters.end_time	string	Required	Parameters for the Get URL Detections action
parameters.timezone	string	Optional	Parameters for the Get URL Detections action
parameters.key	string	Optional	Parameters for the Get URL Detections action
parameters.key_id	string	Optional	Parameters for the Get URL Detections action
parameters.subkey_id	string	Optional	Parameters for the Get URL Detections action
parameters.orderby	string	Optional	Parameters for the Get URL Detections action
parameters.max_results	string	Optional	Parameters for the Get URL Detections action
parameters.offset_results	string	Optional	Parameters for the Get URL Detections action
parameters.detected_url_id	string	Optional	Parameters for the Get URL Detections action
parameters.event_id	string	Optional	Parameters for the Get URL Detections action
parameters.include_not_analyzed	string	Optional	Parameters for the Get URL Detections action
parameters.task_uuid	string	Optional	Parameters for the Get URL Detections action
parameters.priority	string	Optional	Parameters for the Get URL Detections action
parameters.min_score	string	Optional	Parameters for the Get URL Detections action
parameters.url	string	Optional	Parameters for the Get URL Detections action
parameters.md5	string	Optional	Parameters for the Get URL Detections action
parameters.http_host	string	Optional	Parameters for the Get URL Detections action
parameters.src_ip	string	Optional	Parameters for the Get URL Detections action
parameters.dst_ip	string	Optional	Parameters for the Get URL Detections action
parameters.homenet	string	Optional	Parameters for the Get URL Detections action
parameters.whitelisting	string	Optional	Parameters for the Get URL Detections action
parameters.analysis_task_typed_tags	string	Optional	Parameters for the Get URL Detections action
parameters.include_typed_tags	string	Optional	Parameters for the Get URL Detections action

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request
md5	string	Output field: md5
detected_url_id	string	URL endpoint for the request
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
timestamp	string	Output field: timestamp
detection_time	string	Time value
event_id	string	Unique identifier
score	string	Score value
pending	string	Output field: pending
task_uuid	string	Unique identifier
src_host	string	Output field: src_host
src_ip	string	Output field: src_ip
src_port	string	Output field: src_port
dst_host	string	Output field: dst_host
dst_ip	string	Output field: dst_ip
dst_port	string	Output field: dst_port
http_host	string	Output field: http_host
user_agent	string	Output field: user_agent
referer	string	Output field: referer
typed_tags	string	Type of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"url":"","md5":"","detected_url_id":"","access_key_id":"","subkey_id":"","timestamp":"","detection_time":"","event_id":"","score":"","pending":"","task_uuid":"","src_host":"","src_ip":"","src_port":"","dst_host":""}...

List Event URLs

Endpoint

URL: papi/net/event/urls

Method: GET

Input

Argument Name	Type	Required	Description
parameters.event_id	string	Optional	Parameters for the List Event URLs action
parameters.event_time	string	Optional	Parameters for the List Event URLs action
parameters.key	string	Optional	Parameters for the List Event URLs action
parameters.key_id	string	Optional	Parameters for the List Event URLs action
parameters.subkey_id	string	Optional	Parameters for the List Event URLs action
parameters.customer	string	Optional	Parameters for the List Event URLs action
parameters.limit	number	Optional	Parameters for the List Event URLs action

Input Example

{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":"","limit":1}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
url	string	URL endpoint for the request
raw_url	string	URL endpoint for the request
method	string	HTTP method to use

Output Example

List Events

Endpoint

URL: papi/net/event/list

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Optional	Parameters for the List Events action
parameters.end_time	string	Optional	Parameters for the List Events action
parameters.timezone	string	Optional	Parameters for the List Events action
parameters.key	string	Optional	Parameters for the List Events action
parameters.key_id	string	Optional	Parameters for the List Events action
parameters.subkey_id	string	Optional	Parameters for the List Events action
parameters.orderby	string	Optional	Parameters for the List Events action
parameters.max_results	number	Optional	Parameters for the List Events action
parameters.offset_results	number	Optional	Parameters for the List Events action
parameters.event_id	string	Optional	Parameters for the List Events action
parameters.incident_id	string	Optional	Parameters for the List Events action
parameters.priority	string	Optional	Parameters for the List Events action
parameters.threat_class	string	Optional	Parameters for the List Events action
parameters.threat	string	Optional	Parameters for the List Events action
parameters.src_id	string	Optional	Parameters for the List Events action
parameters.relevant_host_ip	string	Optional	Parameters for the List Events action
parameters.other_host_ip	string	Optional	Parameters for the List Events action
parameters.relevant_host_hostname	string	Optional	Parameters for the List Events action
parameters.other_host	string	Optional	Parameters for the List Events action
parameters.host_tag	string	Optional	Parameters for the List Events action
parameters.src_ip	string	Optional	Parameters for the List Events action
parameters.dest_ip	string	Optional	Parameters for the List Events action
parameters.src_hostname	string	Optional	Parameters for the List Events action
parameters.entry	string	Optional	Parameters for the List Events action
parameters.min_impact	string	Optional	Parameters for the List Events action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":1,"offset_results":1,"event_id":"","incident_id":"","priority":"","threat_class":"","threat":"","src_id":"","relevant_host_ip":"","other_host_ip":"","relevant_host_hostname":"","other_host":"","host_tag":"","src_ip":"","dest_ip":"","src_hostname":"","entry":"","min_impact":"","transport":"","port":"","whitelisting":"","homenet":"","event_outcome":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
event_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
start_time	string	Time value
end_time	string	Time value
transport	string	Output field: transport
occurrences	number	Output field: occurrences
blocked	boolean	Output field: blocked
relevant_host_ip	string	Output field: relevant_host_ip
other_host_ip	string	Output field: other_host_ip
server_port	number	Output field: server_port
relevant_host_hostname	string	Name of the resource
other_host_hostname	string	Name of the resource
src_host	string	Output field: src_host
dst_host	string	Output field: dst_host
dst_port	number	Output field: dst_port
src_hostname	string	Name of the resource
src_id	string	Unique identifier
host_label	string	Output field: host_label
host_whitelisted	boolean	Output field: host_whitelisted
src_mac	string	Output field: src_mac
entry	string	Output field: entry

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"event_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"23/01/2023","end_time":"23/01/2023","transport":"","occurrences":1,"blocked":true,"relevant_host_ip":"","other_host_ip":"","...

List Incidents

Endpoint

URL: papi/net/incident/list

Method: GET

Input

Argument Name	Type	Required	Description
parameters.start_time	string	Required	Parameters for the List Incidents action
parameters.end_time	string	Required	Parameters for the List Incidents action
parameters.timezone	string	Optional	Parameters for the List Incidents action
parameters.key	string	Optional	Parameters for the List Incidents action
parameters.key_id	string	Optional	Parameters for the List Incidents action
parameters.subkey_id	string	Optional	Parameters for the List Incidents action
parameters.max_results	number	Optional	Parameters for the List Incidents action
parameters.offset_results	number	Optional	Parameters for the List Incidents action
parameters.priority	string	Optional	Parameters for the List Incidents action
parameters.threat_class	string	Optional	Parameters for the List Incidents action
parameters.threat	string	Optional	Parameters for the List Incidents action
parameters.src_id	string	Optional	Parameters for the List Incidents action
parameters.src_ip	string	Optional	Parameters for the List Incidents action
parameters.src_hostname	string	Optional	Parameters for the List Incidents action
parameters.archived	string	Optional	Parameters for the List Incidents action
parameters.read	string	Optional	Parameters for the List Incidents action
parameters.whitelisting	string	Optional	Parameters for the List Incidents action
parameters.homenet	string	Optional	Parameters for the List Incidents action
parameters.breach_uuid	string	Optional	Parameters for the List Incidents action
parameters.host_tag	string	Optional	Parameters for the List Incidents action
parameters.incidents_older_than	string	Optional	Parameters for the List Incidents action

Input Example

{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","max_results":1,"offset_results":1,"priority":"","threat_class":"","threat":"","src_id":"","src_ip":"","src_hostname":"","archived":"","read":"","whitelisting":"","homenet":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
incident_id	string	Unique identifier
access_key_id	string	Unique identifier
subkey_id	string	Unique identifier
time	string	Time value
start_time	string	Time value
end_time	string	Time value
events	number	Output field: events
src_host	string	Output field: src_host
num_src_ips	number	Output field: num_src_ips
src_hostname	string	Name of the resource
blocked	string	Output field: blocked
src_id	string	Unique identifier
src_label	string	Output field: src_label
host_label	string	Output field: host_label
host_whitelisted	string	Output field: host_whitelisted
threat	string	Output field: threat
threat_class	string	Output field: threat_class
impact	string	Output field: impact
is_archived	string	Output field: is_archived
is_read	string	Output field: is_read
archived_cause	string	Output field: archived_cause
breach_uuid	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"","end_time":"","events":1,"src_host":"","num_src_ips":1,"src_hostname":"","blocked":"","src_id":"","src_label":"","host_...

Response Headers

Header	Description	Example
Content-Length	The length of the response body in bytes	65
Content-Type	The media type of the resource	application/json; charset=utf-8
Date	The date and time at which the message was originated	Tue, 20 Jun 2023 15:12:14 GMT
Server	Information about the software used by the origin server	ingress-nginx
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=15724800; includeSubDomains
Via	HTTP response header: Via	1.1 google