API
api
The API, or Application Programming Interface, object represents information pertaining to an API request and response.
Contents
Attributes
Caption | Name | Type | Is Array | Default | Description |
---|---|---|---|---|---|
Group | group | Group | The information pertaining to the API group. | ||
Operation | operation | String | Verb/Operation associated with the request | ||
Raw Data | raw_data | JSON | The event data as received from the event source. | ||
Record ID | record_id | String | Unique identifier for the object | ||
API Request Details | request | Request Elements | Details pertaining to the API request. | ||
API Response Details | response | Response Elements | Details pertaining to the API response. | ||
Service | service | Service | The information pertaining to the API service. | ||
Unmapped Data | unmapped | Unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. | ||
Version | version | String | The version of the API service. |
References
Referenced By
- Security Finding
- Vulnerability Finding
- Detection Finding
- Data Security Finding
- Incident Finding
- Compliance Finding
- Finding
- Base Event
- Entity Management
- Authentication
- Authorize Session
- User Access Management
- Account Change
- Identity & Access Management
- Group Management
- Memory Activity
- Process Activity
- Kernel Activity
- File System Activity
- System Activity
- Scheduled Job Activity
- Event Log Activity
- Module Activity
- Kernel Extension Activity
- Web Resources Activity
- Web Resource Access Activity
- API Activity
- Datastore Activity
- File Hosting Activity
- Application Lifecycle
- Scan Activity
- Application Activity
- Network File Activity
- Tunnel Activity
- RDP Activity
- HTTP Activity
- Email File Activity
- Network Activity
- DHCP Activity
- FTP Activity
- SSH Activity
- SMB Activity
- DNS Activity
- Email Activity
- NTP Activity
- Email URL Activity
- Network
- User Query
- Discovery Result
- Device Inventory Info
- OSINT Inventory Info
- Software Inventory Info
- User Session Query
- Device Config State
- Discovery
- User Inventory Info
- Device Config State Change
- Peripheral Device Query
- Operating System Patch State
- Process Remediation Activity
- Network Remediation Activity
- Remediation Activity
- File Remediation Activity
- Windows Service Activity
- Windows Resource Activity
- Registry Key Query
- Registry Value Query
- Registry Key Activity
- Prefetch Query
- Registry Value Activity
- Email Delivery Activity
- Windows Evidence Artifacts
- Resource Details
Context
JSON
{
"caption": "API",
"description": "The API, or Application Programming Interface, object represents information pertaining to an API request and response.",
"extends": "object",
"name": "api",
"attributes": {
"group": {
"description": "The information pertaining to the API group.",
"requirement": "optional",
"caption": "Group",
"type": "group"
},
"operation": {
"requirement": "required",
"caption": "Operation",
"description": "Verb/Operation associated with the request",
"type": "string_t"
},
"request": {
"description": "Details pertaining to the API request.",
"requirement": "recommended",
"caption": "API Request Details",
"type": "request"
},
"response": {
"description": "Details pertaining to the API response.",
"requirement": "recommended",
"caption": "API Response Details",
"type": "response"
},
"service": {
"description": "The information pertaining to the API service.",
"requirement": "optional",
"caption": "Service",
"type": "service"
},
"version": {
"description": "The version of the API service.",
"requirement": "optional",
"caption": "Version",
"type": "string_t"
},
"raw_data": {
"group": "context",
"caption": "Raw Data",
"description": "The event data as received from the event source.",
"type": "json_t"
},
"record_id": {
"description": "Unique identifier for the object",
"group": "primary",
"requirement": "required",
"caption": "Record ID",
"type": "string_t"
},
"unmapped": {
"caption": "Unmapped Data",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"type": "unmapped",
"is_array": true
}
}
}