@@ -433,6 +433,13 @@ components:
433433 required: true
434434 schema:
435435 type: string
436+ HistoricalSignalID:
437+ description: The ID of the historical signal.
438+ in: path
439+ name: histsignal_id
440+ required: true
441+ schema:
442+ type: string
436443 IncidentAttachmentFilterQueryParameter:
437444 description: Specifies which types of attachments are included in the response.
438445 explode: false
@@ -745,6 +752,58 @@ components:
745752 required: true
746753 schema:
747754 type: string
755+ QueryFilterFrom:
756+ description: The minimum timestamp for requested security signals.
757+ example: '2019-01-02T09:42:36.320Z'
758+ in: query
759+ name: filter[from]
760+ required: false
761+ schema:
762+ format: date-time
763+ type: string
764+ QueryFilterSearch:
765+ description: The search query for security signals.
766+ example: security:attack status:high
767+ in: query
768+ name: filter[query]
769+ required: false
770+ schema:
771+ type: string
772+ QueryFilterTo:
773+ description: The maximum timestamp for requested security signals.
774+ example: '2019-01-03T09:42:36.320Z'
775+ in: query
776+ name: filter[to]
777+ required: false
778+ schema:
779+ format: date-time
780+ type: string
781+ QueryPageCursor:
782+ description: A list of results using the cursor provided in the previous query.
783+ example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
784+ in: query
785+ name: page[cursor]
786+ required: false
787+ schema:
788+ type: string
789+ QueryPageLimit:
790+ description: The maximum number of security signals in the response.
791+ example: 25
792+ in: query
793+ name: page[limit]
794+ required: false
795+ schema:
796+ default: 10
797+ format: int32
798+ maximum: 1000
799+ type: integer
800+ QuerySort:
801+ description: The order of the security signals in results.
802+ in: query
803+ name: sort
804+ required: false
805+ schema:
806+ $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
748807 RelationInclude:
749808 description: Include relationship data.
750809 explode: true
@@ -65306,52 +65365,12 @@ paths:
6530665365 security signals.'
6530765366 operationId: ListSecurityMonitoringSignals
6530865367 parameters:
65309- - description: The search query for security signals.
65310- example: security:attack status:high
65311- in: query
65312- name: filter[query]
65313- required: false
65314- schema:
65315- type: string
65316- - description: The minimum timestamp for requested security signals.
65317- example: '2019-01-02T09:42:36.320Z'
65318- in: query
65319- name: filter[from]
65320- required: false
65321- schema:
65322- format: date-time
65323- type: string
65324- - description: The maximum timestamp for requested security signals.
65325- example: '2019-01-03T09:42:36.320Z'
65326- in: query
65327- name: filter[to]
65328- required: false
65329- schema:
65330- format: date-time
65331- type: string
65332- - description: The order of the security signals in results.
65333- in: query
65334- name: sort
65335- required: false
65336- schema:
65337- $ref: '#/components/schemas/SecurityMonitoringSignalsSort'
65338- - description: A list of results using the cursor provided in the previous query.
65339- example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==
65340- in: query
65341- name: page[cursor]
65342- required: false
65343- schema:
65344- type: string
65345- - description: The maximum number of security signals in the response.
65346- example: 25
65347- in: query
65348- name: page[limit]
65349- required: false
65350- schema:
65351- default: 10
65352- format: int32
65353- maximum: 1000
65354- type: integer
65368+ - $ref: '#/components/parameters/QueryFilterSearch'
65369+ - $ref: '#/components/parameters/QueryFilterFrom'
65370+ - $ref: '#/components/parameters/QueryFilterTo'
65371+ - $ref: '#/components/parameters/QuerySort'
65372+ - $ref: '#/components/parameters/QueryPageCursor'
65373+ - $ref: '#/components/parameters/QueryPageLimit'
6535565374 responses:
6535665375 '200':
6535765376 content:
@@ -66632,6 +66651,123 @@ paths:
6663266651 permissions:
6663366652 - incident_settings_write
6663466653 x-unstable: '**Note**: This endpoint is deprecated.'
66654+ /api/v2/siem-historical-detections/histsignals:
66655+ get:
66656+ description: List hist signals.
66657+ operationId: ListSecurityMonitoringHistsignals
66658+ parameters:
66659+ - $ref: '#/components/parameters/QueryFilterSearch'
66660+ - $ref: '#/components/parameters/QueryFilterFrom'
66661+ - $ref: '#/components/parameters/QueryFilterTo'
66662+ - $ref: '#/components/parameters/QuerySort'
66663+ - $ref: '#/components/parameters/QueryPageCursor'
66664+ - $ref: '#/components/parameters/QueryPageLimit'
66665+ responses:
66666+ '200':
66667+ content:
66668+ application/json:
66669+ schema:
66670+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66671+ description: OK
66672+ '400':
66673+ $ref: '#/components/responses/BadRequestResponse'
66674+ '403':
66675+ $ref: '#/components/responses/NotAuthorizedResponse'
66676+ '404':
66677+ $ref: '#/components/responses/NotFoundResponse'
66678+ '429':
66679+ $ref: '#/components/responses/TooManyRequestsResponse'
66680+ security:
66681+ - apiKeyAuth: []
66682+ appKeyAuth: []
66683+ - AuthZ:
66684+ - security_monitoring_signals_read
66685+ summary: List hist signals
66686+ tags:
66687+ - Security Monitoring
66688+ x-permission:
66689+ operator: OR
66690+ permissions:
66691+ - security_monitoring_signals_read
66692+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66693+
66694+ Please check the documentation regularly for updates.'
66695+ /api/v2/siem-historical-detections/histsignals/search:
66696+ get:
66697+ description: Search hist signals.
66698+ operationId: SearchSecurityMonitoringHistsignals
66699+ requestBody:
66700+ content:
66701+ application/json:
66702+ schema:
66703+ $ref: '#/components/schemas/SecurityMonitoringSignalListRequest'
66704+ required: false
66705+ responses:
66706+ '200':
66707+ content:
66708+ application/json:
66709+ schema:
66710+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
66711+ description: OK
66712+ '400':
66713+ $ref: '#/components/responses/BadRequestResponse'
66714+ '403':
66715+ $ref: '#/components/responses/NotAuthorizedResponse'
66716+ '404':
66717+ $ref: '#/components/responses/NotFoundResponse'
66718+ '429':
66719+ $ref: '#/components/responses/TooManyRequestsResponse'
66720+ security:
66721+ - apiKeyAuth: []
66722+ appKeyAuth: []
66723+ - AuthZ:
66724+ - security_monitoring_signals_read
66725+ summary: Search hist signals
66726+ tags:
66727+ - Security Monitoring
66728+ x-permission:
66729+ operator: OR
66730+ permissions:
66731+ - security_monitoring_signals_read
66732+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66733+
66734+ Please check the documentation regularly for updates.'
66735+ /api/v2/siem-historical-detections/histsignals/{histsignal_id}:
66736+ get:
66737+ description: Get a hist signal's details.
66738+ operationId: GetSecurityMonitoringHistsignal
66739+ parameters:
66740+ - $ref: '#/components/parameters/HistoricalSignalID'
66741+ responses:
66742+ '200':
66743+ content:
66744+ application/json:
66745+ schema:
66746+ $ref: '#/components/schemas/SecurityMonitoringSignalResponse'
66747+ description: OK
66748+ '400':
66749+ $ref: '#/components/responses/BadRequestResponse'
66750+ '403':
66751+ $ref: '#/components/responses/NotAuthorizedResponse'
66752+ '404':
66753+ $ref: '#/components/responses/NotFoundResponse'
66754+ '429':
66755+ $ref: '#/components/responses/TooManyRequestsResponse'
66756+ security:
66757+ - apiKeyAuth: []
66758+ appKeyAuth: []
66759+ - AuthZ:
66760+ - security_monitoring_signals_read
66761+ summary: Get a hist signal's details
66762+ tags:
66763+ - Security Monitoring
66764+ x-permission:
66765+ operator: OR
66766+ permissions:
66767+ - security_monitoring_signals_read
66768+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
66769+
66770+ Please check the documentation regularly for updates.'
6663566771 /api/v2/siem-historical-detections/jobs:
6663666772 get:
6663766773 description: List historical jobs.
@@ -66853,6 +66989,48 @@ paths:
6685366989 - security_monitoring_rules_write
6685466990 x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
6685566991
66992+ Please check the documentation regularly for updates.'
66993+ /api/v2/siem-historical-detections/jobs/{job_id}/histsignals:
66994+ get:
66995+ description: Get a job's hist signals.
66996+ operationId: GetSecurityMonitoringHistsignalsByJobId
66997+ parameters:
66998+ - $ref: '#/components/parameters/HistoricalJobID'
66999+ - $ref: '#/components/parameters/QueryFilterSearch'
67000+ - $ref: '#/components/parameters/QueryFilterFrom'
67001+ - $ref: '#/components/parameters/QueryFilterTo'
67002+ - $ref: '#/components/parameters/QuerySort'
67003+ - $ref: '#/components/parameters/QueryPageCursor'
67004+ - $ref: '#/components/parameters/QueryPageLimit'
67005+ responses:
67006+ '200':
67007+ content:
67008+ application/json:
67009+ schema:
67010+ $ref: '#/components/schemas/SecurityMonitoringSignalsListResponse'
67011+ description: OK
67012+ '400':
67013+ $ref: '#/components/responses/BadRequestResponse'
67014+ '403':
67015+ $ref: '#/components/responses/NotAuthorizedResponse'
67016+ '404':
67017+ $ref: '#/components/responses/NotFoundResponse'
67018+ '429':
67019+ $ref: '#/components/responses/TooManyRequestsResponse'
67020+ security:
67021+ - apiKeyAuth: []
67022+ appKeyAuth: []
67023+ - AuthZ:
67024+ - security_monitoring_signals_read
67025+ summary: Get a job's hist signals
67026+ tags:
67027+ - Security Monitoring
67028+ x-permission:
67029+ operator: OR
67030+ permissions:
67031+ - security_monitoring_signals_read
67032+ x-unstable: '**Note**: This endpoint is in beta and may be subject to changes.
67033+
6685667034 Please check the documentation regularly for updates.'
6685767035 /api/v2/slo/report:
6685867036 post:
0 commit comments