v1

latestOpenAPI 3.0.02026-07-17166300328.1 KB

Events

Search events

post/events/index

Request body

pageinteger nullable

limitinteger nullable

Maximum number of results to be returned. Can't be greater than the one set for your role. 0 means maximum.

sortstring nullable

Field to be used to sort the result

direction'asc' | 'desc' nullable

Sort direction of the result

minimalboolean nullable

Returns a minimal version of the event, only events with attributeCount > 0 will be returned

attributestring nullable

Filter events matching the given string with attributes values

eventidstring

datefromstring date nullable

Event creation date is greater or equal

dateuntilstring date nullable

Event creation date is less or equal

orgstring nullable

Filter events by matching the creator organisation name

eventinfostring nullable

Filter events by matching the event info text

tagstring

tagsTagName[] nullable

Filter events by matching any of the event tags of a given list of tag names

distribution'0' | '1' | '2' | '3' | '4' | '5'

Who will be able to see this event once it becomes published and eventually when it becomes pulled:

0 - Your organization only
1 - This community only
2 - Connected communities
3 - All communities
4 - Sharing group
5 - Inherit Event

analysis'0' | '1' | '2'

Represents the analysis maturity level.

0 - Initial
1 - Ongoing
2 - Complete

threatlevel'1' | '2' | '3' | '4'

Represents the threat level.

1 - High
2 - Medium
3 - Low
4 - Undefined

extendingboolean

Whether to include events that are extending another one. If set to 1, only events extending another will be returned. If set to 0, only events that are not extending another will be returned. Omit or [0,1] to disregard extension state.

extendedboolean

Whether to include events that are extended by another one. If set to 1, only events extended by another will be returned. If set to 0, only events that are not extended by another will be returned. Omit or [0,1] to disregard extension state.

emailstring email nullable

Filter events by matching the event creator user email

hasproposalstring nullable

Filter events by checking if it has attributes with change proposals. Possible values: 0, 1

timestampstring nullable

Event timestamp greater or equal

publish_timestampstring nullable

Event publish timestamp greater or equal

searchDatefromstring nullable

Filters on the date, anything newer than the given date in YYYY-MM-DD format is taken - non-negatable

searchDateuntilstring nullable

Filters on the date, anything older than the given date in YYYY-MM-DD format is taken - non-negatable

Example request

{
  "sort": "timestamp",
  "attribute": "covert channel",
  "eventid": "12345",
  "datefrom": "2021-03-05",
  "dateuntil": "2021-03-05",
  "org": "CIRCL",
  "eventinfo": "Phishing campaign",
  "tag": "tlp:white",
  "tags": [
    "tlp:amber",
    "cycat:scope=\"exploit\""
  ],
  "distribution": "4",
  "sharinggroup": "1",
  "email": "admin@admin.test",
  "hasproposal": "1",
  "timestamp": "1",
  "publish_timestamp": "1",
  "searchDatefrom": "2020-01-20",
  "searchDateuntil": "2020-01-20"
}

Response

A list of events with extended properties

idstring

org_idstring

distribution'0' | '1' | '2' | '3' | '4' | '5'

Who will be able to see this event once it becomes published and eventually when it becomes pulled:

0 - Your organization only
1 - This community only
2 - Connected communities
3 - All communities
4 - Sharing group
5 - Inherit Event

infostring

orgc_idstring

uuidstring uuid

datestring

publishedboolean

analysis'0' | '1' | '2'

Represents the analysis maturity level.

0 - Initial
1 - Ongoing
2 - Complete

attribute_countstring

timestampstring nullable

proposal_email_lockboolean

lockedboolean

threat_level_id'1' | '2' | '3' | '4'

Represents the threat level.

1 - High
2 - Medium
3 - Low
4 - Undefined

publish_timestampstring

sighting_timestampstring

disable_correlationboolean

extends_uuidstring nullable

event_creator_emailstring email