List Events
List and query events.
Basic Parameters
Parameter | Description |
---|---|
Occurred After | Return alarms that occurred after given date. |
Occurred Before | Return alarms that occurred before given date. |
Sort | Sort by a given parameter and direction. |
Advanced Parameters
Parameter | Description |
---|---|
Account Name | The name of the account. |
Event Name | The name of the event. |
Limit | The maximum number of results to return per page. |
Page Number | The number of the page to return. |
Plugin Name | The name of the plugin. |
Sensor UUID | The UUID of the source sensor. |
Source Name | The name of the source. |
Source Username | The username of the person that triggered the event. |
Suppressed | Return alarms with the suppressed flag. |
Example Output
{
"_links": {
"first": {
"href": "https://mysubdomain.alienvault.cloud/api/2.0/events?page=0&size=20&sort=timestamp_occured,desc",
"templated": false
},
"self": {
"href": "https://mysubdomain.alienvault.cloud/api/2.0/events",
"templated": false
},
"next": {
"href": "https://mysubdomain.alienvault.cloud/api/2.0/events?page=1&size=20&sort=timestamp_occured,desc",
"templated": false
},
"last": {
"href": "https://mysubdomain.alienvault.cloud/api/2.0/events?page=175&size=20&sort=timestamp_occured,desc",
"templated": false
}
},
"_embedded": {
"events": [
{
"uuid": "39a6918f-33f2-ec9b-0fcc-42bb90f10a1f",
"account_name": "generic-account",
"plugin_device_type": "Cloud Infrastructure",
"destination_canonical": "s3.amazonaws.com",
"destination_name": "s3.amazonaws.com",
"has_alarm": false,
"request_user_agent": "s3.amazonaws.com",
"packet_type": "log",
"source_canonical": "s3.amazonaws.com",
"event_name": "PutObject",
"timestamp_occured": "1528817037000",
"source_service_name": "s3.amazonaws.com",
"event_type": "AwsApiCall",
"app_name": "amazon-aws",
"timestamp_received": "1528817107938",
"destination_hostname": "s3.amazonaws.com",
"source_infrastructure_name": "Amazon Global",
"plugin": "Amazon AWS CloudTrail",
"app_type": "amazon-aws",
"authentication_type": "AWSService",
"access_control_outcome": "Allow",
"suppressed": "false",
"plugin_device": "CloudTrail",
"destination_infrastructure_type": "Cloud Service",
"source_infrastructure_type": "Cloud Service",
"destination_zone": "us-east-1",
"needs_enrichment": true,
"source_hostname": "s3.amazonaws.com",
"app_id": "amazon-aws",
"plugin_family": "Amazon",
"plugin_version": "0.24",
"destination_userid": "101720206348",
"event_action": "Create",
"destination_infrastructure_name": "Amazon Global",
"source_name": "s3.amazonaws.com",
"received_from": "s3.amazonaws.com",
"event_description": "Action for uploading an object (PUT or POST).",
"_links": {
"self": {
"href": "https://mysubdomain.aveng.us/api/2.0/events/39a6918f-33f2-ec9b-0fcc-42bb90f10a1f",
"templated": false
}
}
}
]
},
"page": {
"size": 20,
"totalElements": 3506,
"totalPages": 176,
"number": 0
}
}
Workflow Library Example
List Events with Alienvault Usm and Send Results Via Email