Security Operations
113 endpoints.
EDR
across connected vendors
GET /api/v1/security-operations/endpoint-security/devices
List Edr Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
Endpoint Security / CrowdStrike
GET /api/v1/edr/crowdstrike/alerts
List Crowd Strike Alerts
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/crowdstrike/alerts/{id}
Get Crowd Strike Alert
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/crowdstrike/devices
List Crowd Strike Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/crowdstrike/devices/search
Search Crowd Strike Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
search | query | yes | Search query |
Responses: 200, 400, 401, 500
GET /api/v1/edr/crowdstrike/devices/{id}
Get Crowd Strike Device
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Endpoint Security / Carbon Black
GET /api/v1/edr/carbonblack/alerts
List Carbon Black Alerts
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/alerts/{id}
Get Carbon Black Alert
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/devices
List Carbon Black Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/devices/search
Search Carbon Black Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
search | query | yes | Search query |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/devices/{id}
Get Carbon Black Device
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/vulnerabilities
List Carbon Black Vulnerabilities
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/vulnerabilities/{id}
Get Carbon Black Vulnerability
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/watchlists
List Carbon Black Watchlists
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/carbonblack/watchlists/{id}
Get Carbon Black Watchlist
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Endpoint Security / SentinelOne
GET /api/v1/edr/sentinelone/agents
List Sentinel One Agents
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/sentinelone/agents/search
Search Sentinel One Agents
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
search | query | yes | Search query |
Responses: 200, 400, 401, 500
GET /api/v1/edr/sentinelone/agents/{id}
Get Sentinel One Agent
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/sentinelone/threats
List Sentinel One Threats
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/sentinelone/threats/{id}
Get Sentinel One Threat
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Endpoint Security / Microsoft Defender
GET /api/v1/edr/defender/devices
List Defender Devices
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/devices/search
Search Defender Devices
Search Defender devices by hostname or IP
| Parameter | In | Required | Description |
|---|---|---|---|
search | query | yes | Search query |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/devices/{id}
Get Defender Device
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/devices/{id}/vulnerabilities
List Defender Device Vulnerabilities
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/recommendations
List Defender Recommendations
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/recommendations/{id}
Get Defender Recommendation
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/software
List Defender Software
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/edr/defender/software/{id}
Get Defender Software
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Detection / Search
POST /api/v1/security-operations/investigations/search
Search Siem
Search SIEM logs
Request body: SiemSearchRequest
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/investigations/search/fields
Siem Fields
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/investigations/search/log/{id}/{dataset}
Get Siem Log By Id
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
dataset | path | yes | dataset identifier |
Responses: 200, 400, 401, 500
Detection / Rules
GET /api/v1/security-operations/detection/rules/counts
Get Rule Counts
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/rules/custom
List Custom Rules
List custom Sigma rules
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/rules/custom
Create Custom Rule
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/rules/custom/{id}
Delete Custom Rule
Delete a custom Sigma rule
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/rules/prepackaged
List Pre Packaged Rules
List pre-packaged Sigma rules
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/rules/{id}/replay
Replay Rule
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Detection / Stats
GET /api/v1/security-operations/detection/stats/by-hour
Get Stats By Hour
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/stats/by-source
Get Stats By Source
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/stats/storage
Get Siem Storage Stats
Responses: 200, 400, 401, 500
Configuration
per-organization SIEM tuning
GET /api/v1/security-operations/detection/configuration/alert-policies
List Alert Policies
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/alert-policies
Create Alert Policy
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/alert-policies/{id}
Delete Alert Policy
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/alert-policies/{id}
Update Alert Policy
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/data-sources
List Data Sources
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/data-sources
Create Data Source
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/data-sources/{id}
Delete Data Source
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/data-sources/{id}
Update Data Source
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/detectors
List Detector Config
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/detectors/{id}
Delete Detector Override
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/detectors/{id}
Get Detector Config
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/detectors/{id}
Upsert Detector Override
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: DetectorOverrideWrite
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/detectors/{id}/preview
Preview Detector Override
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: HandlePreviewDetectorOverrideRequest
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/environment-objects
List Environment Objects
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/environment-objects
Create Environment Object
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/environment-objects/{id}
Delete Environment Object
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/environment-objects/{id}
Update Environment Object
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/legal-holds
Create Legal Hold
Request body: LegalHoldWrite
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/legal-holds/{id}
Release Legal Hold
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/maintenance-windows
List Maintenance Windows
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/maintenance-windows
Create Maintenance Window
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/maintenance-windows/{id}
Delete Maintenance Window
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/maintenance-windows/{id}
Update Maintenance Window
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/overview
Configuration Overview
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/retention
Get Retention
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/retention
Update Retention
Request body: RetentionPolicyWrite
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/settings
Get Org Settings
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/settings
Update Org Settings
Request body: OrgSettingsWrite
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/suppressions
List Suppressions
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/detection/configuration/suppressions
Create Suppression
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/detection/configuration/suppressions/{id}
Delete Suppression
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/detection/configuration/suppressions/{id}
Update Suppression
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/detection/configuration/versions
List Configuration Versions
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
Telemetry / Sources
GET /api/v1/security-operations/telemetry/sources/eventhub
List Event Hub Configs
List Event Hub consumer configs
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/telemetry/sources/eventhub
Create Event Hub Config
Create an Event Hub consumer config
Request body: EventHubConsumerConfigCreate
Responses: 200, 400, 401, 500
DELETE /api/v1/security-operations/telemetry/sources/eventhub/{id}
Delete Event Hub Config
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/telemetry/sources/eventhub/{id}
Get Event Hub Config
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/telemetry/sources/eventhub/{id}
Update Event Hub Config
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: EventHubConsumerConfigUpdate
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/telemetry/sources/status
Get Siem Config Status
Responses: 200, 400, 401, 500
Telemetry / Identity Activity
identity provider and SaaS activity; Entra ID and Microsoft 365
GET /api/v1/security-operations/investigations/identity-activity/provisioning
List Provisioning
List SCIM provisioning events (today: Entra)
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/investigations/identity-activity/risk-events
List Risk Events
List risk-flagged auth events (today: Entra Identity Protection)
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/investigations/identity-activity/security-alerts
List Security Alerts
List SaaS / productivity security alerts (today: M365 / Defender)
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/investigations/identity-activity/sign-ins
List Sign Ins
List IdP sign-in events (today: Entra)
Responses: 200, 400, 401, 500
Alerts
GET /api/v1/security-operations/monitor/soc/alerts
List Alerts
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/alerts
Create Alert
Request body: SocAlertCreateRequest
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/alerts/assignee/{id}
Get Alerts By Assignee
List alerts assigned to a specific user
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/alerts/batch
Create Alert Batch
Request body: SocAlertBatchCreateRequest
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/alerts/my
Get My Alerts
List alerts assigned to the current user
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/alerts/stats
Get Alert Stats
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/alerts/{id}
Get Alert
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/monitor/soc/alerts/{id}/assign
Assign Alert
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: AssignRequest
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/alerts/{id}/resolve
Resolve Alert
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: ResolveRequest
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/monitor/soc/alerts/{id}/status
Update Alert Status
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: SocAlertStatusUpdate
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/assignees
List Assignees
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/dashboard
Get Dashboard
Responses: 200, 400, 401, 500
Incidents
GET /api/v1/security-operations/monitor/soc/incidents
List Incidents
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/incidents
Create Incident
Request body: SocIncidentCreateRequest
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/incidents/from-logs
Create Incident From Logs
Request body: SocIncidentFromLogsRequest
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/incidents/lead/{id}
Get Incidents By Lead
List incidents for a specific investigation lead
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/incidents/my
Get My Incidents
List incidents where the current user is investigation lead
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/incidents/stats
Get Incident Stats
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/incidents/{id}
Get Incident
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/monitor/soc/incidents/{id}
Update Incident
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: SocIncidentUpdate
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/incidents/{id}/alerts
Get Incident Alerts
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/monitor/soc/incidents/{id}/assign
Assign Incident Lead
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: AssignRequest
Responses: 200, 400, 401, 500
PATCH /api/v1/security-operations/monitor/soc/incidents/{id}/status
Update Incident Status
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: SocIncidentStatusUpdate
Responses: 200, 400, 401, 500
Response Actions
GET /api/v1/security-operations/monitor/soc/response-actions/pending
List Pending Actions
| Parameter | In | Required | Description |
|---|---|---|---|
paginateFrom | query | no | Pagination offset (0-based) |
paginateSize | query | no | Items per page |
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/response-actions/stats
Get Response Action Stats
Responses: 200, 400, 401, 500
GET /api/v1/security-operations/monitor/soc/response-actions/{id}
Get Response Action
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/response-actions/{id}/approve
Approve Action
Approve a pending response action
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/response-actions/{id}/reject
Reject Action
Reject a pending response action
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Request body: RejectActionRequest
Responses: 200, 400, 401, 500
POST /api/v1/security-operations/monitor/soc/response-actions/{id}/rollback
Rollback Action
Rollback an executed response action
| Parameter | In | Required | Description |
|---|---|---|---|
id | path | yes | id identifier |
Responses: 200, 400, 401, 500
Search
POST /api/v1/collector_communication/logs
Collector Logs
Request body: CollectorLogBatch
Responses: 200, 400, 401, 500