Search Events

The Events API enables you to retrieve the evidence or observation details by invoking the following endpoint:

POST https://YourAccount.lacework.net/api/v2/Events/search

FortiCNAPP highly recommends specifying a time range in the request to narrow the search. If no time range is specified, the request uses the default time range of 24 hours before the current time. The maximum time range per API request is 7 days. To use the current time as the end time, exclude the endTime field.

You can optionally filter the returned users by eventType, srcType, and more.

Here are some example body payloads:

• { "timeFilter": { "startTime": "2022-03-18T00:00:00Z", "endTime": "2022-03-18T12:00:00Z"}}
• { "timeFilter": { "startTime": "2022-03-18T00:00:00Z", "endTime": "2022-03-18T12:00:00Z"}, "filters": [ { "field": "eventType", "expression": "eq", "value": "CloudTrailDefaultAlert" } ] }
• { "timeFilter": { "startTime": "2022-03-18T00:00:00Z", "endTime": "2022-03-18T12:00:00Z"}, "filters": [ { "field": "srcType", "expression": "eq", "value": "AwsResource" }, { "field": "srcEvent.awsRegion", "expression": "eq", "value": "us-west-2" } ],
  "returns": [ "id", "srcEvent", "srcType" ] }