--- title: "Alert Entity Details" method: GET path: "/api/v2/Alerts/EntityDetails/{alertId}" tags: ["Alerts"] --- # Alert Entity Details `GET /api/v2/Alerts/EntityDetails/{alertId}` Get details about an entity associated with a given alert ID for which additional context is available by invoking the following endpoint: > `GET https://YourAccount.lacework.net/api/v2/Alerts/EntityDetails/{alertId}?contextEntityType={entityType}&entityValue={entityValue}` You must specify a `contextEntityType` and `entityValue`. (Currently, additional context support is available for IpAddress entities only, so `contextEntityType` must be `Machine` or `IpAddress`.) If any item of information about this entity is not available, partial information is returned. ## Path parameters - `alertId` string, required ## Query parameters - `contextEntityType` 'IpAddress' | 'Machine', required - `entityValue` string, required ## Headers - `Authorization` string, required - `Content-Type` string, required ## Response `200` Alert Entity Details - union - AlertsIPResponseSchemaFinalized - `contextEntityType` 'IpAddress' — This field is used for the response schema option; it will not be in the response. - `data` object[] - `networkActivityOverview` object - `externalServerConn` object — Total number of outgoing network connections to external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalClientConn` object — Total number of incoming network connections from external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalInBytes` object — Total number of bytes received from external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalOutBytes` object — Total number of bytes sent to external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `isAgentInstalled` boolean — Whether the FortiCNAPP agent is installed on the machine with this IP address. - `isInternalIp` boolean — Whether this is an internal IP address. - `uniqueProcessDetails` object — Information regarding unique processes associated with the alert. - `uniqueProcesses` object[] — Unique processes associated with the IP address. - `cmdLine` string — The command that launched the process. - `launchTime` number — The time when the process started. - `hostname` string — The hostname of the machine on which the process is running. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - `ipAddressSummary` object — Location information for an IP address associated with the alert. - `country` string — Country name associated with the IP address. - `region` string — Region associated with the IP address. - `city` string — City associated with the IP address. - `countryCode` string — Country code associated with the IP address - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - `resolvedIpInformation` object — DNS server information for a resolved IP address associated with the alert. - `resolvedIPInfo` object[] — Resolved IP information. - `dnsResolverIp` string — IP address of the DNS server. - `dnsName` string — The fully qualified domain name of the DNS server. - `resolvedIp` string — Resolved IP address of the machine. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - `virusTotal` object — Risk assessment of an IP address associated with the alert by VirusTotal. - `securityVendorsCount` number — The number of security vendors who have marked this IP address as malicious. - `source` string — Source of evaluation. - `network` string — IPv4 network range to which the IP belongs, in slash notation format. - `autonomousSystemNumber` string — The number of the autonomous system to which the IP address belongs. - `autonomousSystemLabel` string — The label of the autonomous system to which the IP address belongs. - `regionalInternalRegistry` string — The regional Internet registry (RIR) associated with this IP address. - `country` string — The country in which the IP address originated. - `continent` string — The continent in which the IP address originated. - `message` string — Error message if there is an error fetching this detail. - `laceworkLabs` object — Risk assessment of an IP address associated with the alert by FortiCNAPP Labs. - `customerCount` number — Failed login attempts from this IP address seen across FortiCNAPP customers. - `badIpAddress` boolean — FortiCNAPP labs identified this IP address as bad. - `threatType` string — The type of threat. - `threatInfo` string — Additional information about the threat. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - AlertsMachineResponseSchemaFinalized - `contextEntityType` 'Machine' — This field is used for the response schema option; it will not be in the response. - `data` object[] - `criticalAndHighRisk` object — Information about critical and high level severity detections related to vulnerabilities, attack paths, and alerts associated with the hostname. - `internetExposure` string — Internet exposure information related to hostname. - `vulnerabilities` object — Information about critical and high level severity vulnerabilities that are fixable from the last seven days. - `criticalCount` number — Count of vulnerabilities with critical severity. - `highCount` number — Count of vulnerabilities with high severity. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `message` string — Error message if there is an error fetching this detail. - `alerts` object — Information about critical and high level severity alerts from the last seven days with the status of open or in-progress. - `criticalCount` number — Count of alerts with critical severity. - `highCount` number — Count of alerts with high severity. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `message` string — Error message if there is an error fetching this detail. - `attackPaths` object — Critical, high, medium, or low severity attack paths from the last 24 hours. FortiCNAPP generates attack paths if critical vulnerabilities are associated with a cloud asset and they are exposed to the internet. - `criticalCount` number — Count of attack paths with critical path severity. - `otherCount` number — Count of attack paths with high, medium and low path severity. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This refers to the last 24 hours time range from last scan. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This refers to the last 24 hours time range from last scan. - `message` string — Error message if there is an error fetching this detail. - `machineProperties` object — Machine properties - `name` string — Hostname of the machine. - `ipAddress` string — IP address of the machine. - `firstKnownTime` number — Time when machine was first detected by the FortiCNAPP agent. - `lastKnownTime` number — Time when machine was last detected by the FortiCNAPP agent. - `lastBootTime` number — Last boot up time of the machine as detected by the FortiCNAPP agent. - `cpu` string — CPU type of the machine. - `osType` string — OS type of the machine. - `memoryInfo` string — Total RAM on the machine. - `kernelRelease` string — Kernel release version of the machine. - `kernelVersion` string — Kernel version of the machine. - `macAddres` string — MAC address of the machine. - `defaultRouter` string — Default router information. - `promiscuous` string — Whether the machine is running in promiscuous mode. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - `machineTagSummary` object — Machine Tags summary. - `amiId` string — ID of machine image used by the machine. - `externalIp` string — External IP address of the machine. - `instanceId` string — Instance ID of the machine. - `subnetId` string — ID of the subnet in which the machine exists. - `vmInstanceType` string — The instance type of the machine. For example, the t2.micro AWS instance type. - `vmProvider` string — The cloud service provider on which the machine is running. - `lwTokenShort` string — The first 30 characters of the agent access token used by the FortiCNAPP agent installed on the machine. - `internalIp` string — Internal IP address of the machine. - `arch` string — The machine architecture type. - `vpcId` string — ID of the VPC in which the machine is running. - `zone` string — The availability zone in which the machine is running. - `os` string — OS type of the machine. - `account` string - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. - `message` string — Error message if there is an error fetching this detail. - `customResourceGroups` object — The custom resource groups associated with this machine. - `resourceGroups` object[] — The custom resource groups associated with this machine. - `resourceGroups` object — Resource group information. - `name` string — Resource group name. - `guid` string — Resource group ID. - `startTimeRange` number — Current time, as an epoch timestamp. - `endTimeRange` number — Current time, as an epoch timestamp. - `message` string — Error message if there is an error fetching this detail. - `cloudServiceProvider` object — Information related to the cloud service provider associated with this host. - `cloudServiceProvider` string — Name of the cloud service provider. - `accountAlias` string — The AWS account alias. - `projectName` string — The Google Cloud project name. - `subscriptionName` string — The Azure subscription name. - `accountId` string — The ID of AWS account. - `projectId` string — The ID of the Google Cloud project. - `subscriptionId` string — The ID of Azure subscription. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This refers to the last 7 days time range. - `message` string — Error message if there is an error fetching this detail. - `networkActivityOverview` object - `externalServerConn` object — Total number of outgoing network connections to external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalClientConn` object — Total number of incoming network connections from external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalInBytes` object — Total number of bytes received from external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `externalOutBytes` object — Total number of bytes sent to external IP addresses. - `count` number - `message` string — Error message if there is an error fetching this detail. - `startTimeRange` number — Start time, as an epoch timestamp, for which data is fetched. This matches the start of the time range in which the alert occurred. - `endTimeRange` number — End time, as an epoch timestamp, for which data is fetched. This matches the end of the time range in which the alert occurred. ## Other responses - `4XX` — Client Error - `5XX` — Internal Server Error --- [API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)