--- title: VMWare Lastline Network slug: connectors/vmware-lastline-network docTags: createdAt: 2026-06-09T16:29:56.115Z --- The VMWare Lastline API offers cybersecurity, vulnerability detection, and network protection services. The VMWare Lastline network API is accessible at: `https://user.lastline.com/papi/net/` On-premise customers should instead access this API on their Lastline Enterprise Manager at: `https://user./papi/net/` An up-to-date version of this documentation can be browsed at [Lastlines API documentation overview](https://user.lastline.com/papi-doc/api/html/overview.html) ## Prerequisites The VMWare Lastline API is a web-based API. To get started, you will need to request a set of credentials for accessing the API from Lastline. These credentials are a Username and a Password. ## Capabilities This plugin provides information on the following areas: - Detected URLs - Downloads - Incidents - Emails - Events # Configurations ## HTTP Basic Authentication Authenticates using username and password. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | Username | string | Required | | password | Password | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Detected URL Stats Get Detected URL Stats ### Endpoint - **URL:** `papi/net/url/stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.start_date` | string | Required | Parameters for the Get Detected URL Stats action | | `parameters.end_date` | string | Required | Parameters for the Get Detected URL Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.time_scale` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.key` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.detected_url_id` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.event_id` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.include_not_analyzed` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.priority` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.min_score` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.url` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.md5` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.http_host` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.src_ip` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.homenet` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Detected URL Stats action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Detected URL Stats action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","time_scale":"","key":"","key_id":"","subkey_id":"","detected_url_id":"","event_id":"","include_not_analyzed":"","task_uuid":"","priority":"","min_score":"","url":"","md5":"","http_host":"","src_ip":"","dst_ip":"","homenet":"","whitelisting":"","analysis_task_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `priority` | string | Output field: priority | | `start_date` | string | Date value | | `end_date` | string | Date value | | `total_urls` | number | URL endpoint for the request | | `distinct_urls` | number | URL endpoint for the request | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"priority":"","start_date":"","end_date":"","total_urls":1,"distinct_urls":1}}` ## Get Download Log Stats Get Download Log Stats ### Endpoint - **URL:** `papi/net/file/download_log_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.start_time` | string | Required | Parameters for the Get Download Log Stats action | | `parameters.end_time` | string | Required | Parameters for the Get Download Log Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.key` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.application_protocol` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.filetype` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.md5` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.sha1` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.src_ip` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.src_host` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.dst_host` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.direction` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.submitted` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.homenet` | string | Optional | Parameters for the Get Download Log Stats action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Download Log Stats action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","application_protocol":"","filetype":"","md5":"","sha1":"","src_ip":"","dst_ip":"","src_host":"","dst_host":"","direction":"","submitted":"","homenet":"","whitelisting":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file_category` | string | Output field: file\_category | | `start_date` | string | Date value | | `total_files` | number | Output field: total\_files | | `distinct_files` | number | Output field: distinct\_files | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_category":"","start_date":"","total_files":1,"distinct_files":1}}` ## Get Download Logs Get Download Logs ### Endpoint - **URL:** `papi/net/file/download_logs` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Download Logs action | | `parameters.end_time` | string | Required | Parameters for the Get Download Logs action | | `parameters.timezone` | string | Optional | Parameters for the Get Download Logs action | | `parameters.key` | string | Optional | Parameters for the Get Download Logs action | | `parameters.key_id` | string | Optional | Parameters for the Get Download Logs action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Download Logs action | | `parameters.orderby` | string | Optional | Parameters for the Get Download Logs action | | `parameters.max_results` | string | Optional | Parameters for the Get Download Logs action | | `parameters.offset_results` | string | Optional | Parameters for the Get Download Logs action | | `parameters.application_protocol` | string | Optional | Parameters for the Get Download Logs action | | `parameters.filetype` | string | Optional | Parameters for the Get Download Logs action | | `parameters.md5` | string | Optional | Parameters for the Get Download Logs action | | `parameters.sha1` | string | Optional | Parameters for the Get Download Logs action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Download Logs action | | `parameters.src_ip` | string | Optional | Parameters for the Get Download Logs action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Download Logs action | | `parameters.src_host` | string | Optional | Parameters for the Get Download Logs action | | `parameters.dst_host` | string | Optional | Parameters for the Get Download Logs action | | `parameters.direction` | string | Optional | Parameters for the Get Download Logs action | | `parameters.submitted` | string | Optional | Parameters for the Get Download Logs action | | `parameters.homenet` | string | Optional | Parameters for the Get Download Logs action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Download Logs action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","application_protocol":"","filetype":"","md5":"","sha1":"","task_uuid":"","src_ip":"","dst_ip":"","src_host":"","dst_host":"","direction":"","submitted":"","homenet":"","whitelisting":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `file_name` | string | Name of the resource | | `file_size` | string | Output field: file\_size | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `raw_url` | string | URL endpoint for the request | | `url` | string | URL endpoint for the request | | `score` | string | Score value | | `task_uuid` | string | Unique identifier | | `src_host` | string | Output field: src\_host | | `src_hostname` | string | Name of the resource | | `src_port` | string | Output field: src\_port | | `dst_host` | string | Output field: dst\_host | | `dst_port` | string | Output field: dst\_port | | `dst_hostname` | string | Name of the resource | | `application_protocol` | string | Output field: application\_protocol | | `file_upload_status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","raw_url":"","url":"","score":"","task_uuid":"","src_host":"","src_hostname":"","src_port":"","dst_host":""}}` ## Get Download Stats Get Download Stats ### Endpoint - **URL:** `papi/net/file/download_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Download Stats action | | `parameters.end_time` | string | Required | Parameters for the Get Download Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Download Stats action | | `parameters.key` | string | Optional | Parameters for the Get Download Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Download Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Download Stats action | | `parameters.include_not_uploaded` | string | Optional | Parameters for the Get Download Stats action | | `parameters.application_protocol` | string | Optional | Parameters for the Get Download Stats action | | `parameters.md5` | string | Optional | Parameters for the Get Download Stats action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Download Stats action | | `parameters.min_score` | string | Optional | Parameters for the Get Download Stats action | | `parameters.src_ip` | string | Optional | Parameters for the Get Download Stats action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Download Stats action | | `parameters.http_host` | string | Optional | Parameters for the Get Download Stats action | | `parameters.homenet` | string | Optional | Parameters for the Get Download Stats action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Download Stats action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Download Stats action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","include_not_uploaded":"","application_protocol":"","md5":"","task_uuid":"","min_score":"","src_ip":"","dst_ip":"","http_host":"","homenet":"","whitelisting":"","analysis_task_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file_category` | string | Output field: file\_category | | `start_date` | string | Date value | | `total_files` | number | Output field: total\_files | | `distinct_files` | number | Output field: distinct\_files | | `max_score` | string | Score value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_category":"","start_date":"","total_files":1,"distinct_files":1,"max_score":""}}` ## Get Downloads Get Downloads ### Endpoint - **URL:** `papi/net/file/downloads` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Downloads action | | `parameters.end_time` | string | Required | Parameters for the Get Downloads action | | `parameters.timezone` | string | Optional | Parameters for the Get Downloads action | | `parameters.key` | string | Optional | Parameters for the Get Downloads action | | `parameters.key_id` | string | Optional | Parameters for the Get Downloads action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Downloads action | | `parameters.orderby` | string | Optional | Parameters for the Get Downloads action | | `parameters.max_results` | string | Optional | Parameters for the Get Downloads action | | `parameters.offset_results` | string | Optional | Parameters for the Get Downloads action | | `parameters.include_not_uploaded` | string | Optional | Parameters for the Get Downloads action | | `parameters.application_protocol` | string | Optional | Parameters for the Get Downloads action | | `parameters.event_id` | string | Optional | Parameters for the Get Downloads action | | `parameters.md5` | string | Optional | Parameters for the Get Downloads action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Downloads action | | `parameters.min_score` | string | Optional | Parameters for the Get Downloads action | | `parameters.filetype` | string | Optional | Parameters for the Get Downloads action | | `parameters.src_ip` | string | Optional | Parameters for the Get Downloads action | | `parameters.src_hostname` | string | Optional | Parameters for the Get Downloads action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Downloads action | | `parameters.http_host` | string | Optional | Parameters for the Get Downloads action | | `parameters.homenet` | string | Optional | Parameters for the Get Downloads action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Downloads action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Downloads action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Downloads action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","include_not_uploaded":"","application_protocol":"","event_id":"","md5":"","task_uuid":"","min_score":"","filetype":"","src_ip":"","src_hostname":"","dst_ip":"","http_host":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `file_name` | string | Name of the resource | | `file_size` | string | Output field: file\_size | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `file_type` | string | Type of the resource | | `extracted_filename` | string | Name of the resource | | `score` | string | Score value | | `pending` | string | Output field: pending | | `task_uuid` | string | Unique identifier | | `event_id` | string | Unique identifier | | `src_host` | string | Output field: src\_host | | `src_hostname` | string | Name of the resource | | `src_port` | string | Output field: src\_port | | `dst_host` | string | Output field: dst\_host | | `dst_port` | string | Output field: dst\_port | | `relevant_host_ip` | string | Output field: relevant\_host\_ip | | `relevant_host_port` | string | Output field: relevant\_host\_port | | `relevant_host_hostname` | string | Name of the resource | | `other_host_ip` | string | Output field: other\_host\_ip | | `other_host_port` | string | Output field: other\_host\_port | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","file_type":"","extracted_filename":"","score":"","pending":"","task_uuid":"","event_id":"","src_host":"","src_hostname":"...` ## Get Event Get Event ### Endpoint - **URL:** `papi/net/event/get` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------- | | `parameters.timezone` | string | Optional | Parameters for the Get Event action | | `parameters.event_id` | string | Optional | Parameters for the Get Event action | | `parameters.start_time` | string | Optional | Parameters for the Get Event action | | `parameters.end_time` | string | Optional | Parameters for the Get Event action | ### Input Example `{"parameters":{"timezone":"","event_id":"","start_time":"","end_time":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `event_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `start_time` | string | Time value | | `end_time` | string | Time value | | `transport` | string | Output field: transport | | `occurrences` | number | Output field: occurrences | | `blocked` | boolean | Output field: blocked | | `relevant_host_ip` | string | Output field: relevant\_host\_ip | | `other_host_ip` | string | Output field: other\_host\_ip | | `server_port` | string | Output field: server\_port | | `relevant_host_hostname` | string | Name of the resource | | `other_host_hostname` | string | Name of the resource | | `src_id` | string | Unique identifier | | `host_label` | string | Output field: host\_label | | `host_whitelisted` | boolean | Output field: host\_whitelisted | | `src_mac` | string | Output field: src\_mac | | `event_type_id` | string | Unique identifier | | `event_type` | string | Type of the resource | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `impact` | string | Output field: impact | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"event_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"23/01/2023","end_time":"23/01/2023","transport":"","occurrences":1,"blocked":true,"relevant_host_ip":"","other_host_ip":"","...` ## Get Event Attributes Get Event Attributes ### Endpoint - **URL:** `papi/net/event/attributes` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.event_id` | string | Required | Parameters for the Get Event Attributes action | | `parameters.event_time` | string | Required | Parameters for the Get Event Attributes action | | `parameters.key` | string | Optional | Parameters for the Get Event Attributes action | | `parameters.key_id` | string | Optional | Parameters for the Get Event Attributes action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Event Attributes action | | `parameters.customer` | string | Optional | Parameters for the Get Event Attributes action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `name` | string | Name of the resource | | `value` | string | Value for the parameter | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"name":"","value":""}}` ## Get Event Blacklist Match Info Get Event Blacklist Match Info ### Endpoint - **URL:** `papi/net/event/blacklist_match` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------------------- | | `parameters.event_id` | string | Required | Parameters for the Get Event Blacklist Match Info action | | `parameters.event_time` | string | Required | Parameters for the Get Event Blacklist Match Info action | | `parameters.key` | string | Optional | Parameters for the Get Event Blacklist Match Info action | | `parameters.key_id` | string | Optional | Parameters for the Get Event Blacklist Match Info action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Event Blacklist Match Info action | | `parameters.customer` | string | Optional | Parameters for the Get Event Blacklist Match Info action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `domain` | string | Output field: domain | | `ip` | string | Output field: ip | | `url_path` | string | URL endpoint for the request | | `port` | string | Output field: port | | `is_local_blacklist` | string | Output field: is\_local\_blacklist | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"domain":"","ip":"","url_path":"","port":"","is_local_blacklist":""}}` ## Get Event Evidence Get Event Evidence ### Endpoint - **URL:** `papi/net/event/evidence` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.event_id` | string | Required | Parameters for the Get Event Evidence action | | `parameters.event_time` | string | Required | Parameters for the Get Event Evidence action | | `parameters.key` | string | Optional | Parameters for the Get Event Evidence action | | `parameters.key_id` | string | Optional | Parameters for the Get Event Evidence action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Event Evidence action | | `parameters.customer` | string | Optional | Parameters for the Get Event Evidence action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `confidence` | string | Unique identifier | | `severity` | string | Output field: severity | | `impact` | string | Output field: impact | | `evidence_type` | string | Unique identifier | | `detector` | string | Output field: detector | | `activity` | string | Output field: activity | | `subject` | string | Output field: subject | | `signature_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"threat":"","threat_class":"","confidence":"","severity":"","impact":"","evidence_type":"","detector":"","activity":"","subject":"","signature_id":""}}` ## Get Event Network IOCs Get Event Network IOCs ### Endpoint - **URL:** `papi/net/event/network_iocs` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.event_id` | string | Required | Parameters for the Get Event Network IOCs action | | `parameters.event_time` | string | Required | Parameters for the Get Event Network IOCs action | | `parameters.key` | string | Optional | Parameters for the Get Event Network IOCs action | | `parameters.key_id` | string | Optional | Parameters for the Get Event Network IOCs action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Event Network IOCs action | | `parameters.customer` | string | Optional | Parameters for the Get Event Network IOCs action | | `parameters.limit` | number | Optional | Parameters for the Get Event Network IOCs action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":"","limit":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `task_uuid` | string | Unique identifier | | `score` | string | Score value | | `domain` | string | Output field: domain | | `ip` | string | Output field: ip | | `url_path` | string | URL endpoint for the request | | `port` | string | Output field: port | | `detector` | string | Output field: detector | | `threat` | string | Output field: threat | | `impact` | string | Output field: impact | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"task_uuid":"","score":"","domain":"","ip":"","url_path":"","port":"","detector":"","threat":"","impact":""}}` ## Get Incident Get Incident ### Endpoint - **URL:** `papi/net/incident/get` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | -------------------------------------- | | `parameters.incident_id` | string | Required | Parameters for the Get Incident action | | `parameters.timezone` | string | Optional | Parameters for the Get Incident action | ### Input Example `{"parameters":{"incident_id":"","timezone":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `incident_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `start_time` | string | Time value | | `end_time` | string | Time value | | `events` | number | Output field: events | | `src_host` | string | Output field: src\_host | | `num_src_ips` | number | Output field: num\_src\_ips | | `src_hostname` | string | Name of the resource | | `blocked` | string | Output field: blocked | | `src_id` | string | Unique identifier | | `src_label` | string | Output field: src\_label | | `host_label` | string | Output field: host\_label | | `host_whitelisted` | string | Output field: host\_whitelisted | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `impact` | string | Output field: impact | | `is_archived` | string | Output field: is\_archived | | `is_read` | string | Output field: is\_read | | `archived_cause` | string | Output field: archived\_cause | | `comment` | string | Output field: comment | | `mitigation` | string | Output field: mitigation | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","access_key_id":"","subkey_id":"","time":"","start_time":"","end_time":"","events":1,"src_host":"","num_src_ips":1,"src_hostname":"","blocked":"","src_id":"","src_label":"","host_label":"","host_whi...` ## Get Incident Evidence Get Incident Evidence ### Endpoint - **URL:** `papi/net/incident/evidence` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------------- | | `parameters.incident_id` | string | Required | Parameters for the Get Incident Evidence action | | `parameters.key` | string | Optional | Parameters for the Get Incident Evidence action | | `parameters.key_id` | string | Optional | Parameters for the Get Incident Evidence action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Incident Evidence action | | `parameters.customer` | string | Optional | Parameters for the Get Incident Evidence action | | `parameters.timezone` | string | Optional | Parameters for the Get Incident Evidence action | | `parameters.extended` | boolean | Optional | Parameters for the Get Incident Evidence action | ### Input Example `{"parameters":{"incident_id":"","key":"","key_id":"","subkey_id":"","customer":"","timezone":"","extended":true}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `confidence` | string | Unique identifier | | `severity` | string | Output field: severity | | `impact` | string | Output field: impact | | `evidence_type` | string | Unique identifier | | `detector` | string | Output field: detector | | `activity` | string | Output field: activity | | `subject` | string | Output field: subject | | `first_seen` | string | Output field: first\_seen | | `last_seen` | string | Output field: last\_seen | | `reference_type` | string | Type of the resource | | `reference_id` | string | Unique identifier | | `reference_time` | string | Time value | | `reference_event` | string | Output field: reference\_event | | `URLs` | string | URL endpoint for the request | | `blacklist_match_info` | string | Output field: blacklist\_match\_info | | `dga_domains` | string | Output field: dga\_domains | | `dga_domain_count` | number | Count value | | `download_file_type` | string | Type of the resource | | `download_file_name` | string | Name of the resource | | `llanta_rule_name` | string | Name of the resource | | `detector_goal` | string | Output field: detector\_goal | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"threat":"","threat_class":"","confidence":"","severity":"","impact":"","evidence_type":"","detector":"","activity":"","subject":"","first_seen":"","last_seen":"","reference_type":"","reference_id":"","reference_tim...` ## Get Incident Stats Get Incident Stats ### Endpoint - **URL:** `papi/net/file/incident_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Incident Stats action | | `parameters.end_date` | string | Required | Parameters for the Get Incident Stats action | | `parameters.time_scale` | string | Required | Parameters for the Get Incident Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.key` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.group_by_impact` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.priority` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.threat_class` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.threat` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.src_id` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.src_ip` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.src_hostname` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.archived` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.read` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.homenet` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.breach_uuid` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.host_tag` | string | Optional | Parameters for the Get Incident Stats action | | `parameters.incidents_older_than` | string | Optional | Parameters for the Get Incident Stats action | ### Input Example `{"parameters":{"start_date":"","end_date":"","time_scale":"","timezone":"","key":"","key_id":"","subkey_id":"","group_by_impact":"","priority":"","threat_class":"","threat":"","src_id":"","src_ip":"","src_hostname":"","archived":"","read":"","whitelisting":"","homenet":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `max_impact` | string | Output field: max\_impact | | `incidents` | number | Unique identifier | | `events` | number | Output field: events | | `sources` | number | Output field: sources | | `priority` | string | Output field: priority | | `start_date` | string | Date value | | `end_date` | string | Date value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"max_impact":"","incidents":1,"events":1,"sources":1,"priority":"","start_date":"","end_date":""}}` ## Get Mail Attachment Stats Get Mail Attachment Stats ### Endpoint - **URL:** `papi/net/mail/attachment_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Mail Attachment Stats action | | `parameters.end_date` | string | Required | Parameters for the Get Mail Attachment Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.key` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.min_score` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.md5` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.action` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Attachment Stats action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail Attachment Stats action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file_type` | string | Type of the resource | | `start_date` | string | Date value | | `total_files` | number | Output field: total\_files | | `distinct_files` | number | Output field: distinct\_files | | `max_score` | string | Score value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"file_type":"","start_date":"","total_files":1,"distinct_files":1,"max_score":""}}` ## Get Mail Attachments Get Mail Attachments ### Endpoint - **URL:** `papi/net/mail/attachments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Attachments action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Attachments action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.key` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.orderby` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.max_results` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.offset_results` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.min_score` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.md5` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.action` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Attachments action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Attachments action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Attachments action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","include_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `file_name` | string | Name of the resource | | `file_type` | string | Type of the resource | | `file_size` | string | Output field: file\_size | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `task_uuid` | string | Unique identifier | | `score` | string | Score value | | `llfiletype` | string | Type of the resource | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `action` | string | Output field: action | | `message_action` | string | Response message | | `typed_tags` | string | Type of the resource | | `appliance_uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","time":"","message_id":"","timestamp":"","file_name":"","file_type":"","file_size":"","md5":"","sha1":"","task_uuid":"","score":"","llfiletype":"","sender":"","recipient":""}}` ## Get Mail Delivery Log Get Mail Delivery Log ### Endpoint - **URL:** `papi/net/mail/mail_delivery_log` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Delivery Log action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Delivery Log action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Delivery Log action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Delivery Log action | | `parameters.mail_message_log_id` | string | Optional | Parameters for the Get Mail Delivery Log action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_delivery_outcome` | string | Output field: mail\_delivery\_outcome | | `delivery_timestamp` | string | Output field: delivery\_timestamp | | `details` | string | Output field: details | | `host` | string | Output field: host | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_delivery_outcome":"","delivery_timestamp":"","details":"","host":""}}` ## Get Mail Detections Get Mail Detections ### Endpoint - **URL:** `papi/net/mail/detections` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Detections action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Detections action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Detections action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Detections action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `detector` | string | Output field: detector | | `action` | string | Output field: action | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"detector":"","action":"","threat":"","threat_class":""}}` ## Get Mail Message Get Mail Message ### Endpoint - **URL:** `papi/net/mail/messages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.start_time` | string | Required | Parameters for the Get Mail Message action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Message action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Message action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Message action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Mail Message action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","include_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `date` | string | Date value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `size` | string | Output field: size | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `attachments` | number | Output field: attachments | | `URLs` | number | URL endpoint for the request | | `impact` | string | Output field: impact | | `relevant_content` | string | Response content | | `message_action` | string | Response message | | `content_action` | string | Response content | | `breach_uuid` | string | Unique identifier | | `assigned_to` | string | Output field: assigned\_to | | `mail_state` | string | Output field: mail\_state | | `typed_tags` | string | Type of the resource | | `mail_processing_state` | string | Output field: mail\_processing\_state | | `mail_analysis_status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","date":"","message_id":"","timestamp":"","size":"","sender":"","recipient":"","subject":"","threat":"","threat_class":"","attachments":1,"URLs":1,"impact":"","relevant_content":""...` ## Get Mail Message Headers Get Mail Message Headers ### Endpoint - **URL:** `papi/net/mail/mail_message_headers` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Message Headers action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Message Headers action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Message Headers action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Message Headers action | | `parameters.mail_message_log_id` | string | Optional | Parameters for the Get Mail Message Headers action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `header_field_name` | string | Name of the resource | | `header_field_body` | string | Request body data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"header_field_name":"","header_field_body":""}}` ## Get Mail Messages Get Mail Messages ### Endpoint - **URL:** `papi/net/mail/messages` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Messages action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Messages action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.key` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.orderby` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.max_results` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.offset_results` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.min_score` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.md5` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.action` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Messages action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Messages action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail Messages action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `date` | string | Date value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `size` | string | Output field: size | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `attachments` | number | Output field: attachments | | `URLs` | number | URL endpoint for the request | | `impact` | string | Output field: impact | | `relevant_content` | string | Response content | | `message_action` | string | Response message | | `content_action` | string | Response content | | `assigned_to` | string | Output field: assigned\_to | | `mail_state` | string | Output field: mail\_state | | `typed_tags` | string | Type of the resource | | `mail_processing_state` | string | Output field: mail\_processing\_state | | `mail_analysis_status` | string | Status value | | `mail_delivery_outcome` | string | Output field: mail\_delivery\_outcome | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","date":"","message_id":"","timestamp":"","size":"","sender":"","recipient":"","subject":"","threat":"","threat_class":"","attachments":1,"URLs":1,"impact":"","relevant_content":""...` ## Get Mail Messages Malware Get Mail Messages Malware ### Endpoint - **URL:** `papi/net/mail/messages_malware` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Mail Messages Malware action | | `parameters.end_date` | string | Required | Parameters for the Get Mail Messages Malware action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.key` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.relevant_content` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.min_impact` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.priority` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.threat` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.threat_class` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.assigned_to` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.mail_state` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Messages Malware action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail Messages Malware action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","recipient":"","subject":"","sender":"","relevant_content":"","min_impact":"","priority":"","threat":"","threat_class":"","message_action":"","content_action":"","blocked":true,"assigned_to":"","mail_state":"","analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `start_time` | string | Time value | | `end_time` | string | Time value | | `max_impact` | string | Output field: max\_impact | | `occurrences` | number | Output field: occurrences | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_time":"","end_time":"","max_impact":"","occurrences":1,"threat":"","threat_class":"","priority":""}}` ## Get Mail Messages Malware Priority Get Mail Messages Malware Priority ### Endpoint - **URL:** `papi/net/mail/messages_malware_priority` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------ | | `parameters.start_date` | string | Required | Parameters for the Get Mail Messages Malware Priority action | | `parameters.end_date` | string | Required | Parameters for the Get Mail Messages Malware Priority action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.key` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.relevant_content` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.min_impact` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.priority` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.threat` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.threat_class` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.assigned_to` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.mail_state` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail Messages Malware Priority action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","recipient":"","subject":"","sender":"","relevant_content":"","min_impact":"","priority":"","threat":"","threat_class":"","message_action":"","content_action":"","blocked":true,"assigned_to":"","mail_state":"","analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{}}` ## Get Mail Messages Stats Get Mail Messages Stats ### Endpoint - **URL:** `papi/net/mail/messages_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Mail Messages Stats action | | `parameters.end_date` | string | Required | Parameters for the Get Mail Messages Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.time_scale` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.key` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.group_by_priority` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.subject` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.sender` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.relevant_content` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.min_impact` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.priority` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.threat` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.threat_class` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.assigned_to` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.mail_state` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail Messages Stats action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail Messages Stats action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","time_scale":"","key":"","key_id":"","subkey_id":"","group_by_priority":"","recipient":"","subject":"","sender":"","relevant_content":"","min_impact":"","priority":"","threat":"","threat_class":"","message_action":"","content_action":"","blocked":true,"assigned_to":"","mail_state":"","analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `start_date` | string | Date value | | `end_date` | string | Date value | | `max_impact` | string | Output field: max\_impact | | `occurrences` | number | Output field: occurrences | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_date":"","end_date":"","max_impact":"","occurrences":1,"priority":""}}` ## Get Mail Processing Log Get Mail Processing Log ### Endpoint - **URL:** `papi/net/mail/mail_processing_log` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail Processing Log action | | `parameters.end_time` | string | Required | Parameters for the Get Mail Processing Log action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail Processing Log action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail Processing Log action | | `parameters.mail_message_log_id` | string | Optional | Parameters for the Get Mail Processing Log action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","mail_message_id":"","mail_message_log_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `state` | string | Output field: state | | `timestamp` | string | Output field: timestamp | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"state":"","timestamp":""}}` ## Get Mail URL Stats Get Mail URL Stats ### Endpoint - **URL:** `papi/net/mail/url_stats` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Mail URL Stats action | | `parameters.end_date` | string | Required | Parameters for the Get Mail URL Stats action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.key` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.subject` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.sender` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.min_score` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.md5` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.action` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail URL Stats action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail URL Stats action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail URL Stats action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `start_date` | string | Date value | | `total_urls` | number | URL endpoint for the request | | `distinct_url` | number | URL endpoint for the request | | `max_score` | string | Score value | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_date":"","total_urls":1,"distinct_url":1,"max_score":""}}` ## Get Mail URLs Get Mail URLs ### Endpoint - **URL:** `papi/net/mail/urls` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | --------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Mail URLs action | | `parameters.end_time` | string | Required | Parameters for the Get Mail URLs action | | `parameters.timezone` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.key` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.key_id` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.orderby` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.max_results` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.offset_results` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.recipient` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.subject` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.sender` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.min_score` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.md5` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.action` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.message_action` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.content_action` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Mail URLs action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Mail URLs action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Mail URLs action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `date` | string | Date value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `url` | string | URL endpoint for the request | | `raw_url` | string | URL endpoint for the request | | `md5` | string | Output field: md5 | | `task_uuid` | string | Unique identifier | | `score` | string | Score value | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `action` | string | Output field: action | | `message_action` | string | Response message | | `typed_tags` | string | Type of the resource | | `appliance_uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","access_key_id":"","subkey_id":"","time":"","date":"","message_id":"","timestamp":"","url":"","raw_url":"","md5":"","task_uuid":"","score":"","sender":"","recipient":"","subject":""}}` ## Get Malware Get Malware ### Endpoint - **URL:** `papi/net/incident/malware` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ------------------------------------- | | `parameters.start_date` | string | Required | Parameters for the Get Malware action | | `parameters.end_date` | string | Required | Parameters for the Get Malware action | | `parameters.timezone` | string | Optional | Parameters for the Get Malware action | | `parameters.key` | string | Optional | Parameters for the Get Malware action | | `parameters.key_id` | string | Optional | Parameters for the Get Malware action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Malware action | | `parameters.split_by_priority` | string | Optional | Parameters for the Get Malware action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Malware action | | `parameters.homenet` | string | Optional | Parameters for the Get Malware action | | `parameters.archived` | string | Optional | Parameters for the Get Malware action | | `parameters.read` | string | Optional | Parameters for the Get Malware action | | `parameters.src_ip` | string | Optional | Parameters for the Get Malware action | | `parameters.src_hostname` | string | Optional | Parameters for the Get Malware action | | `parameters.breach_uuid` | string | Optional | Parameters for the Get Malware action | | `parameters.host_tag` | string | Optional | Parameters for the Get Malware action | | `parameters.incidents_older_than` | string | Optional | Parameters for the Get Malware action | ### Input Example `{"parameters":{"start_date":"","end_date":"","timezone":"","key":"","key_id":"","subkey_id":"","split_by_priority":"","whitelisting":"","homenet":"","archived":"","read":"","src_ip":"","src_hostname":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}` ### Output | **Parameter** | **Type** | **Description** | | -------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `start_time` | string | Time value | | `end_time` | string | Time value | | `max_impact` | string | Output field: max\_impact | | `incidents` | number | Unique identifier | | `events` | number | Output field: events | | `sources` | number | Output field: sources | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `priority` | string | Output field: priority | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"start_time":"","end_time":"","max_impact":"","incidents":1,"events":1,"sources":1,"threat":"","threat_class":"","priority":""}}` ## Get Similar Event Filters Get Similar Event Filters ### Endpoint - **URL:** `papi/net/event/similar_events_filters/get` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.event_id` | string | Required | Parameters for the Get Similar Event Filters action | | `parameters.event_time` | string | Required | Parameters for the Get Similar Event Filters action | | `parameters.key` | string | Optional | Parameters for the Get Similar Event Filters action | | `parameters.key_id` | string | Optional | Parameters for the Get Similar Event Filters action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Similar Event Filters action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":""}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `relevant_host_ip` | string | Output field: relevant\_host\_ip | | `other_host_ip` | string | Output field: other\_host\_ip | | `server_port` | string | Output field: server\_port | | `other_host_hostname` | string | Name of the resource | | `transport_protocol` | string | Output field: transport\_protocol | | `relevant_host_in_homenet` | string | Output field: relevant\_host\_in\_homenet | | `other_host_in_homenet` | string | Output field: other\_host\_in\_homenet | | `relevant_host_whitelisted` | string | Output field: relevant\_host\_whitelisted | | `detector` | string | Output field: detector | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `event_outcome` | string | Output field: event\_outcome | | `event_type` | string | Type of the resource | | `file_category` | string | Output field: file\_category | | `file_type` | string | Type of the resource | | `av_class` | string | Output field: av\_class | | `malware` | string | Output field: malware | | `llanta_rule_uuid` | string | Unique identifier | | `custom_ids_rule_id` | string | Unique identifier | | `relevant_host_tags` | string | Output field: relevant\_host\_tags | | `other_host_tags` | string | Output field: other\_host\_tags | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"relevant_host_ip":"","other_host_ip":"","server_port":"","other_host_hostname":"","transport_protocol":"","relevant_host_in_homenet":"","other_host_in_homenet":"","relevant_host_whitelisted":"","detector":"","threa...` ## Get Source Incident Evidence Get Source Incident Evidence ### Endpoint - **URL:** `papi/net/incident/host_evidence` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------ | | `parameters.start_time` | string | Required | Parameters for the Get Source Incident Evidence action | | `parameters.end_time` | string | Required | Parameters for the Get Source Incident Evidence action | | `parameters.src_ip` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.key` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.key_id` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.customer` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.timezone` | string | Optional | Parameters for the Get Source Incident Evidence action | | `parameters.extended` | boolean | Optional | Parameters for the Get Source Incident Evidence action | ### Input Example `{"parameters":{"start_time":"","end_time":"","src_ip":"","key":"","key_id":"","subkey_id":"","customer":"","timezone":"","extended":true}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `incident_id` | string | Unique identifier | | `reference_event` | string | Output field: reference\_event | | `URLs` | string | URL endpoint for the request | | `blacklist_match_info` | string | Output field: blacklist\_match\_info | | `dga_domains` | string | Output field: dga\_domains | | `dga_domain_count` | number | Count value | | `download_file_type` | string | Type of the resource | | `download_file_name` | string | Name of the resource | | `llanta_rule_name` | string | Name of the resource | | `detector_goal` | string | Output field: detector\_goal | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","reference_event":"","URLs":"","blacklist_match_info":"","dga_domains":"","dga_domain_count":1,"download_file_type":"","download_file_name":"","llanta_rule_name":"","detector_goal":""}}` ## Get Unique Detected URLs Get Unique Detected URLs ### Endpoint - **URL:** `papi/net/url/unique` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Unique Detected URLs action | | `parameters.end_time` | string | Required | Parameters for the Get Unique Detected URLs action | | `parameters.timezone` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.key` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.key_id` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.orderby` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.max_results` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.offset_results` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.detected_url_id` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.event_id` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.include_not_analyzed` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.priority` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.min_score` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.url` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.md5` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.http_host` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.src_ip` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.homenet` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Unique Detected URLs action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Unique Detected URLs action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","detected_url_id":"","event_id":"","include_not_analyzed":"","task_uuid":"","priority":"","min_score":"","url":"","md5":"","http_host":"","src_ip":"","dst_ip":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `url` | string | URL endpoint for the request | | `md5` | string | Output field: md5 | | `num_requests` | number | Output field: num\_requests | | `num_sensors` | number | Output field: num\_sensors | | `first_seen` | string | Output field: first\_seen | | `last_seen` | string | Output field: last\_seen | | `score` | string | Score value | | `pending` | string | Output field: pending | | `task_uuid` | string | Unique identifier | | `src_ip` | string | Output field: src\_ip | | `dst_ip` | string | Output field: dst\_ip | | `num_source_ips` | number | Output field: num\_source\_ips | | `num_dst_ips` | number | Output field: num\_dst\_ips | | `http_host` | string | Output field: http\_host | | `num_http_host` | number | Output field: num\_http\_host | | `typed_tags` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"url":"","md5":"","num_requests":1,"num_sensors":1,"first_seen":"","last_seen":"","score":"","pending":"","task_uuid":"","src_ip":"","dst_ip":"","num_source_ips":1,"num_dst_ips":1,"http_host":"","num_http_host":1}}` ## Get Unique Downloads Get Unique Downloads ### Endpoint - **URL:** `papi/net/file/unique_downloads` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Unique Downloads action | | `parameters.end_time` | string | Required | Parameters for the Get Unique Downloads action | | `parameters.timezone` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.key` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.key_id` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.orderby` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.max_results` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.offset_results` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.include_not_uploaded` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.application_protocol` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.event_id` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.md5` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.min_score` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.filetype` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.src_ip` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.src_hostname` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.dst_ip` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.http_host` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.homenet` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.whitelisting` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Unique Downloads action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Unique Downloads action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","include_not_uploaded":"","application_protocol":"","event_id":"","md5":"","task_uuid":"","min_score":"","filetype":"","src_ip":"","src_hostname":"","dst_ip":"","http_host":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `file_name` | string | Name of the resource | | `file_size` | string | Output field: file\_size | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `file_type` | string | Type of the resource | | `extracted_filename` | string | Name of the resource | | `score` | string | Score value | | `pending` | string | Output field: pending | | `task_uuid` | string | Unique identifier | | `event_id` | string | Unique identifier | | `src_host` | string | Output field: src\_host | | `src_hostname` | string | Name of the resource | | `src_port` | string | Output field: src\_port | | `dst_host` | string | Output field: dst\_host | | `dst_port` | string | Output field: dst\_port | | `relevant_host_ip` | string | Output field: relevant\_host\_ip | | `relevant_host_port` | string | Output field: relevant\_host\_port | | `relevant_host_hostname` | string | Name of the resource | | `other_host_ip` | string | Output field: other\_host\_ip | | `other_host_port` | string | Output field: other\_host\_port | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"access_key_id":"","subkey_id":"","time":"","file_name":"","file_size":"","md5":"","sha1":"","file_type":"","extracted_filename":"","score":"","pending":"","task_uuid":"","event_id":"","src_host":"","src_hostname":"...` ## Get Unique Mail Attachments Get Unique Mail Attachments ### Endpoint - **URL:** `papi/net/mail/unique_attachments` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ----------------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Unique Mail Attachments action | | `parameters.end_time` | string | Required | Parameters for the Get Unique Mail Attachments action | | `parameters.timezone` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.key` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.key_id` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.orderby` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.max_results` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.offset_results` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.recipient` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.subject` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.sender` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.min_score` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.md5` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.action` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.message_action` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.content_action` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Unique Mail Attachments action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Unique Mail Attachments action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","include_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `file_name` | string | Name of the resource | | `file_type` | string | Type of the resource | | `file_size` | string | Output field: file\_size | | `md5` | string | Output field: md5 | | `sha1` | string | Output field: sha1 | | `task_uuid` | string | Unique identifier | | `score` | string | Score value | | `llfiletype` | string | Type of the resource | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `action` | string | Output field: action | | `message_action` | string | Response message | | `typed_tags` | string | Type of the resource | | `appliance_uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","subkey_id":"","time":"","message_id":"","timestamp":"","file_name":"","file_type":"","file_size":"","md5":"","sha1":"","task_uuid":"","score":"","llfiletype":"","sender":"","recipient":""}}` ## Get Unique Mail URLs Get Unique Mail URLs ### Endpoint - **URL:** `papi/net/mail/unique_urls` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get Unique Mail URLs action | | `parameters.end_time` | string | Required | Parameters for the Get Unique Mail URLs action | | `parameters.timezone` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.key` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.key_id` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.subkey_id` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.orderby` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.max_results` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.offset_results` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.mail_message_id` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.recipient` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.subject` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.sender` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.min_score` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.md5` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.task_uuid` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.action` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.message_action` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.content_action` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.blocked` | boolean | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.mail_processing_state` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.mail_analysis_status` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.mail_delivery_outcome` | string | Optional | Parameters for the Get Unique Mail URLs action | | `parameters.lastline_mail_uuid` | string | Optional | Parameters for the Get Unique Mail URLs action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","mail_message_id":"","recipient":"","subject":"","sender":"","min_score":"","md5":"","task_uuid":"","action":"","message_action":"","content_action":"","blocked":true,"analysis_task_typed_tags":"","mail_processing_state":"","mail_analysis_status":"","mail_delivery_outcome":"","lastline_mail_uuid":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `mail_message_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `date` | string | Date value | | `message_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `url` | string | URL endpoint for the request | | `raw_url` | string | URL endpoint for the request | | `md5` | string | Output field: md5 | | `task_uuid` | string | Unique identifier | | `score` | string | Score value | | `sender` | string | Output field: sender | | `recipient` | string | Output field: recipient | | `subject` | string | Output field: subject | | `action` | string | Output field: action | | `message_action` | string | Response message | | `typed_tags` | string | Type of the resource | | `appliance_uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"mail_message_id":"","access_key_id":"","subkey_id":"","time":"","date":"","message_id":"","timestamp":"","url":"","raw_url":"","md5":"","task_uuid":"","score":"","sender":"","recipient":"","subject":""}}` ## Get URL Detections Get URL Detections ### Endpoint - **URL:** `papi/net/url/all` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the Get URL Detections action | | `parameters.end_time` | string | Required | Parameters for the Get URL Detections action | | `parameters.timezone` | string | Optional | Parameters for the Get URL Detections action | | `parameters.key` | string | Optional | Parameters for the Get URL Detections action | | `parameters.key_id` | string | Optional | Parameters for the Get URL Detections action | | `parameters.subkey_id` | string | Optional | Parameters for the Get URL Detections action | | `parameters.orderby` | string | Optional | Parameters for the Get URL Detections action | | `parameters.max_results` | string | Optional | Parameters for the Get URL Detections action | | `parameters.offset_results` | string | Optional | Parameters for the Get URL Detections action | | `parameters.detected_url_id` | string | Optional | Parameters for the Get URL Detections action | | `parameters.event_id` | string | Optional | Parameters for the Get URL Detections action | | `parameters.include_not_analyzed` | string | Optional | Parameters for the Get URL Detections action | | `parameters.task_uuid` | string | Optional | Parameters for the Get URL Detections action | | `parameters.priority` | string | Optional | Parameters for the Get URL Detections action | | `parameters.min_score` | string | Optional | Parameters for the Get URL Detections action | | `parameters.url` | string | Optional | Parameters for the Get URL Detections action | | `parameters.md5` | string | Optional | Parameters for the Get URL Detections action | | `parameters.http_host` | string | Optional | Parameters for the Get URL Detections action | | `parameters.src_ip` | string | Optional | Parameters for the Get URL Detections action | | `parameters.dst_ip` | string | Optional | Parameters for the Get URL Detections action | | `parameters.homenet` | string | Optional | Parameters for the Get URL Detections action | | `parameters.whitelisting` | string | Optional | Parameters for the Get URL Detections action | | `parameters.analysis_task_typed_tags` | string | Optional | Parameters for the Get URL Detections action | | `parameters.include_typed_tags` | string | Optional | Parameters for the Get URL Detections action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":"","offset_results":"","detected_url_id":"","event_id":"","include_not_analyzed":"","task_uuid":"","priority":"","min_score":"","url":"","md5":"","http_host":"","src_ip":"","dst_ip":"","homenet":"","whitelisting":"","analysis_task_typed_tags":"","include_typed_tags":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `url` | string | URL endpoint for the request | | `md5` | string | Output field: md5 | | `detected_url_id` | string | URL endpoint for the request | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `timestamp` | string | Output field: timestamp | | `detection_time` | string | Time value | | `event_id` | string | Unique identifier | | `score` | string | Score value | | `pending` | string | Output field: pending | | `task_uuid` | string | Unique identifier | | `src_host` | string | Output field: src\_host | | `src_ip` | string | Output field: src\_ip | | `src_port` | string | Output field: src\_port | | `dst_host` | string | Output field: dst\_host | | `dst_ip` | string | Output field: dst\_ip | | `dst_port` | string | Output field: dst\_port | | `http_host` | string | Output field: http\_host | | `user_agent` | string | Output field: user\_agent | | `referer` | string | Output field: referer | | `typed_tags` | string | Type of the resource | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"url":"","md5":"","detected_url_id":"","access_key_id":"","subkey_id":"","timestamp":"","detection_time":"","event_id":"","score":"","pending":"","task_uuid":"","src_host":"","src_ip":"","src_port":"","dst_host":""}...` ## List Event URLs List Event URLs ### Endpoint - **URL:** `papi/net/event/urls` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.event_id` | string | Optional | Parameters for the List Event URLs action | | `parameters.event_time` | string | Optional | Parameters for the List Event URLs action | | `parameters.key` | string | Optional | Parameters for the List Event URLs action | | `parameters.key_id` | string | Optional | Parameters for the List Event URLs action | | `parameters.subkey_id` | string | Optional | Parameters for the List Event URLs action | | `parameters.customer` | string | Optional | Parameters for the List Event URLs action | | `parameters.limit` | number | Optional | Parameters for the List Event URLs action | ### Input Example `{"parameters":{"event_id":"","event_time":"","key":"","key_id":"","subkey_id":"","customer":"","limit":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `url` | string | URL endpoint for the request | | `raw_url` | string | URL endpoint for the request | | `method` | string | HTTP method to use | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"url":"","raw_url":"","method":""}}` ## List Events List Events ### Endpoint - **URL:** `papi/net/event/list` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------- | -------- | ------------ | ------------------------------------- | | `parameters.start_time` | string | Optional | Parameters for the List Events action | | `parameters.end_time` | string | Optional | Parameters for the List Events action | | `parameters.timezone` | string | Optional | Parameters for the List Events action | | `parameters.key` | string | Optional | Parameters for the List Events action | | `parameters.key_id` | string | Optional | Parameters for the List Events action | | `parameters.subkey_id` | string | Optional | Parameters for the List Events action | | `parameters.orderby` | string | Optional | Parameters for the List Events action | | `parameters.max_results` | number | Optional | Parameters for the List Events action | | `parameters.offset_results` | number | Optional | Parameters for the List Events action | | `parameters.event_id` | string | Optional | Parameters for the List Events action | | `parameters.incident_id` | string | Optional | Parameters for the List Events action | | `parameters.priority` | string | Optional | Parameters for the List Events action | | `parameters.threat_class` | string | Optional | Parameters for the List Events action | | `parameters.threat` | string | Optional | Parameters for the List Events action | | `parameters.src_id` | string | Optional | Parameters for the List Events action | | `parameters.relevant_host_ip` | string | Optional | Parameters for the List Events action | | `parameters.other_host_ip` | string | Optional | Parameters for the List Events action | | `parameters.relevant_host_hostname` | string | Optional | Parameters for the List Events action | | `parameters.other_host` | string | Optional | Parameters for the List Events action | | `parameters.host_tag` | string | Optional | Parameters for the List Events action | | `parameters.src_ip` | string | Optional | Parameters for the List Events action | | `parameters.dest_ip` | string | Optional | Parameters for the List Events action | | `parameters.src_hostname` | string | Optional | Parameters for the List Events action | | `parameters.entry` | string | Optional | Parameters for the List Events action | | `parameters.min_impact` | string | Optional | Parameters for the List Events action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","orderby":"","max_results":1,"offset_results":1,"event_id":"","incident_id":"","priority":"","threat_class":"","threat":"","src_id":"","relevant_host_ip":"","other_host_ip":"","relevant_host_hostname":"","other_host":"","host_tag":"","src_ip":"","dest_ip":"","src_hostname":"","entry":"","min_impact":"","transport":"","port":"","whitelisting":"","homenet":"","event_outcome":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `event_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `start_time` | string | Time value | | `end_time` | string | Time value | | `transport` | string | Output field: transport | | `occurrences` | number | Output field: occurrences | | `blocked` | boolean | Output field: blocked | | `relevant_host_ip` | string | Output field: relevant\_host\_ip | | `other_host_ip` | string | Output field: other\_host\_ip | | `server_port` | number | Output field: server\_port | | `relevant_host_hostname` | string | Name of the resource | | `other_host_hostname` | string | Name of the resource | | `src_host` | string | Output field: src\_host | | `dst_host` | string | Output field: dst\_host | | `dst_port` | number | Output field: dst\_port | | `src_hostname` | string | Name of the resource | | `src_id` | string | Unique identifier | | `host_label` | string | Output field: host\_label | | `host_whitelisted` | boolean | Output field: host\_whitelisted | | `src_mac` | string | Output field: src\_mac | | `entry` | string | Output field: entry | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"event_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"23/01/2023","end_time":"23/01/2023","transport":"","occurrences":1,"blocked":true,"relevant_host_ip":"","other_host_ip":"","...` ## List Incidents List Incidents ### Endpoint - **URL:** `papi/net/incident/list` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.start_time` | string | Required | Parameters for the List Incidents action | | `parameters.end_time` | string | Required | Parameters for the List Incidents action | | `parameters.timezone` | string | Optional | Parameters for the List Incidents action | | `parameters.key` | string | Optional | Parameters for the List Incidents action | | `parameters.key_id` | string | Optional | Parameters for the List Incidents action | | `parameters.subkey_id` | string | Optional | Parameters for the List Incidents action | | `parameters.max_results` | number | Optional | Parameters for the List Incidents action | | `parameters.offset_results` | number | Optional | Parameters for the List Incidents action | | `parameters.priority` | string | Optional | Parameters for the List Incidents action | | `parameters.threat_class` | string | Optional | Parameters for the List Incidents action | | `parameters.threat` | string | Optional | Parameters for the List Incidents action | | `parameters.src_id` | string | Optional | Parameters for the List Incidents action | | `parameters.src_ip` | string | Optional | Parameters for the List Incidents action | | `parameters.src_hostname` | string | Optional | Parameters for the List Incidents action | | `parameters.archived` | string | Optional | Parameters for the List Incidents action | | `parameters.read` | string | Optional | Parameters for the List Incidents action | | `parameters.whitelisting` | string | Optional | Parameters for the List Incidents action | | `parameters.homenet` | string | Optional | Parameters for the List Incidents action | | `parameters.breach_uuid` | string | Optional | Parameters for the List Incidents action | | `parameters.host_tag` | string | Optional | Parameters for the List Incidents action | | `parameters.incidents_older_than` | string | Optional | Parameters for the List Incidents action | ### Input Example `{"parameters":{"start_time":"","end_time":"","timezone":"","key":"","key_id":"","subkey_id":"","max_results":1,"offset_results":1,"priority":"","threat_class":"","threat":"","src_id":"","src_ip":"","src_hostname":"","archived":"","read":"","whitelisting":"","homenet":"","breach_uuid":"","host_tag":"","incidents_older_than":""}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `incident_id` | string | Unique identifier | | `access_key_id` | string | Unique identifier | | `subkey_id` | string | Unique identifier | | `time` | string | Time value | | `start_time` | string | Time value | | `end_time` | string | Time value | | `events` | number | Output field: events | | `src_host` | string | Output field: src\_host | | `num_src_ips` | number | Output field: num\_src\_ips | | `src_hostname` | string | Name of the resource | | `blocked` | string | Output field: blocked | | `src_id` | string | Unique identifier | | `src_label` | string | Output field: src\_label | | `host_label` | string | Output field: host\_label | | `host_whitelisted` | string | Output field: host\_whitelisted | | `threat` | string | Output field: threat | | `threat_class` | string | Output field: threat\_class | | `impact` | string | Output field: impact | | `is_archived` | string | Output field: is\_archived | | `is_read` | string | Output field: is\_read | | `archived_cause` | string | Output field: archived\_cause | | `breach_uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 20 Jun 2023 15:12:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":65,"Strict-Transport-Security":"max-age=15724800; includeSubDomains","Server":"ingress-nginx","Via":"1.1 google"},"reason":"OK","json_body":{"incident_id":"","access_key_id":"","subkey_id":"","time":"20130623T13:22-0500","start_time":"","end_time":"","events":1,"src_host":"","num_src_ips":1,"src_hostname":"","blocked":"","src_id":"","src_label":"","host_...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | -------------------------------------------------------- | ----------------------------------- | | Content-Length | The length of the response body in bytes | 65 | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Tue, 20 Jun 2023 15:12:14 GMT | | Server | Information about the software used by the origin server | ingress-nginx | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains | | Via | HTTP response header: Via | 1.1 google |