External DocumentationTo learn more, visit the Vectra Detect documentation.
Basic Parameters
| Parameter | Description |
|---|---|
| Fields | A comma-separated list of fields to include in the response. When omitted all fields are returned. |
| Mac Address | Filter hosts by their MAC address. |
| Name | Filter hosts by their name. |
| Page | The page number to return. |
| Page Size | The maximum number of results to return. |
| Return All Pages | Automatically fetch all resources, page by page. |
| Sort | Order results by a specific attribute. Note: Results are sorted in ascending order by default. Add a leading - (minus sign) to sort in descending order instead. |
| State | Filter hosts by their state. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Active Traffic | Select to filter hosts that have generated active traffic within the last 2 hours. |
| Certainty Score | Filter hosts by their certainty score. |
| Certainty Score Greater Than or Equal To | Only return hosts with a certainty score greater than or equal to the specified value. |
| Key Asset | Select to filter by key asset. |
| Last Detection Timestamp | Filter hosts by their last detection timestamp. |
| Last Source IP | Filter hosts by the IP address of their last source. |
| Maximum ID | Return only hosts whose ID is less than or equal to the specified value. |
| Minimum ID | Return only hosts whose ID is greater than or equal to the specified value. |
| Note Modified Timestamp Greater Than or Equal To | Only return hosts with a note_modified_timestamp field value greater than or equal to the specified value. |
| Privilege Category | Filter hosts by their privilege category. |
| Privilege Level | Filter hosts by their exact privilege level. |
| Privilege Level Greater Than or Equal To | Only return hosts with a privilege level greater than or equal to the specified value. |
| Tags | Filter hosts based on their tags. Note: Hosts that match any of the specified tags will be returned. |
| Target Key Asset | Select to filter hosts by targeting key assets. |
| Threat Score | Filter hosts by their threat score. |
| Threat Score Greater Than or Equal To | Only return hosts with a threat score greater than or equal to the specified value. |
Example Output
{
"count": 0,
"next": "https://dummy.link",
"previous": "https://dummy.link",
"results": [
{
"id": 1,
"name": "string",
"active_traffic": true,
"threat": 80,
"t_score": 80,
"certainty": 80,
"c_score": 80,
"severity": "medium",
"last_source": "192.168.1.55",
"ip": "192.168.1.55",
"previous_ips": [
"string"
],
"last_detection_timestamp": "2022-01-01T00:00:00Z",
"is_key_asset": true,
"state": "active",
"is_targeting_key_asset": true,
"detection_set": [
"https://dummy.link"
],
"host_artifact_set": [
"string"
],
"sensor": "string",
"sensor_name": "string",
"tags": [
"string"
],
"note": "string",
"note_modified_by": "string",
"note_modified_timestamp": "2022-01-01T00:00:00Z",
"notes": [
{
"id": 1,
"date_created": "2022-01-01T00:00:00Z",
"date_modified": "2022-01-01T00:00:00Z",
"created_by": "string",
"modified_by": "string",
"note": "string"
}
],
"url": "https://dummy.link",
"host_url": "https://dummy.link",
"last_modified": "2022-01-01T00:00:00Z",
"assigned_to": "string",
"assigned_date": "2022-01-01T00:00:00Z",
"groups": [
"string"
],
"has_custom_model": true,
"privilege_level": 8,
"privilege_category": "Medium",
"probable_owner": "string",
"detection_profile": "string",
"assignment": {
"id": 1,
"assigned_by": {
"id": 123,
"username": "SAML:dummy@company.com"
},
"date_assigned": "2022-01-01T00:00:00Z",
"date_resolved": "2022-01-01T00:00:00Z",
"events": [
{
"assignment_id": 1,
"actor": 1,
"event_type": "created",
"datetime": "2022-01-01T00:00:00Z",
"context": {
"from": 1,
"to": 1,
"entity_c_score": 80,
"entity_t_score": 80,
"triage_as": "string",
"triaged_detection_ids": [
1
],
"fixed_detection_ids": [
1
],
"created_rule_ids": [
1
]
}
}
],
"outcome": {
"id": 1,
"builtin": true,
"user_selectable": true,
"title": "string",
"category": "benign_true_positive"
},
"resolved_by": {
"id": 123,
"username": "SAML:dummy@company.com"
},
"triaged_detections": [
1
],
"host_id": 1,
"account_id": 1,
"assigned_to": {
"id": 123,
"username": "SAML:dummy@company.com"
}
},
"past_assignments": [
{
"id": 1,
"assigned_by": {
"id": 123,
"username": "SAML:dummy@company.com"
},
"date_assigned": "2022-01-01T00:00:00Z",
"date_resolved": "2022-01-01T00:00:00Z",
"events": [
{
"assignment_id": 1,
"actor": 1,
"event_type": "created",
"datetime": "2022-01-01T00:00:00Z",
"context": {
"from": 1,
"to": 1,
"entity_c_score": 80,
"entity_t_score": 80,
"triage_as": "string",
"triaged_detection_ids": [
1
],
"fixed_detection_ids": [
1
],
"created_rule_ids": [
1
]
}
}
],
"outcome": {
"id": 1,
"builtin": true,
"user_selectable": true,
"title": "string",
"category": "benign_true_positive"
},
"resolved_by": {
"id": 123,
"username": "SAML:dummy@company.com"
},
"triaged_detections": [
1
],
"host_id": 1,
"account_id": 1,
"assigned_to": {
"id": 123,
"username": "SAML:dummy@company.com"
}
}
],
"host_session_luids": [
"string"
],
"host_luid": "string"
}
]
}
Workflow Library Example
List Hosts with Vectra Detect and Send Results Via Email