ReadOnly role or higher.
External DocumentationTo learn more, visit the Halcyon documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Action | Select the action that was taken to filter results by. |
| Alert ID | A comma-separated list of alert IDs to filter the results to. |
| Display Status | Select the display status to filter results by. |
| Last Seen After | Return only alerts last seen after this date and time. |
| Last Seen Before | Return only alerts last seen before this date and time. |
| Page | The page number of the results to retrieve. |
| Page Size | Select the number of results to return per page. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Triage Status | Select the triage status to filter results by. |
| Type | Select the alert type to filter results by. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Count Greater Than | Return only alerts with an occurrence count greater than this value. |
| Count Less Than | Return only alerts with an occurrence count less than this value. |
| First Seen After | Return only alerts first seen after this date and time. |
| First Seen Before | Return only alerts first seen before this date and time. |
| Offending Sha256 | A comma-separated list of SHA256 hashes of the offending module. Returns all alerts whose SHA256 starts with any of the given values. |
| Sort By | Select the field to sort the results by. |
| Sort Order | Select the order of the sorted results. |
Example Output
{
"items": [
{
"action": "Block",
"alertType": "BadBehavior",
"assetCount": 0,
"displayStatus": "Hidden",
"firstOccurredAt": "2019-08-24T14:15:22Z",
"id": "string",
"kind": "BadFileExtension",
"lastOccurredAt": "2019-08-24T14:15:22Z",
"primaryProcess": {
"artifact": {
"filePath": "string",
"kind": "Certificate",
"sha256": "string"
},
"commandLine": "string",
"kind": "DriverProcessResponse",
"modules": [
{
"filePath": "string",
"kind": "Certificate",
"sha256": "string"
}
],
"parentPid": "string",
"pid": "string",
"userId": "string",
"username": "string"
},
"processes": [
{
"artifact": {
"filePath": "string",
"kind": "Certificate",
"sha256": "string"
},
"commandLine": "string",
"kind": "DriverProcessResponse",
"modules": [
{
"filePath": "string",
"kind": "Certificate",
"sha256": "string"
}
],
"parentPid": "string",
"pid": "string",
"userId": "string",
"username": "string"
}
],
"summary": {
"artifact": {
"classificationDetails": "string",
"classificationType": "Benign",
"filePath": "string",
"kind": "Driver",
"sha256": "string"
},
"badCommandLine": "string",
"badExtension": "string",
"kind": "DriverArtifactSummaryResponse"
},
"tenantId": "f97df110-f4de-492e-8849-4a6af68026b0",
"totalOccurrences": 0,
"triageStatus": "New"
}
],
"pagination": {
"currentPage": 0,
"nextPage": 0,
"previousPage": 0,
"totalItems": 0,
"totalPages": 0
}
}
Workflow Library Example
List Alerts with Halcyon and Send Results Via Email