This DLP SaaS Incident API allows you to retrieve incidents in a bulk including their details in a specific time period. These incidents are also displayed in the Data protection workspace.
Prerequisites
Trellix DLP SaaS Incident APIs use JWT tokens for authorization. The token contains "scopes" that determine the specific APIs the caller is authorized to access. In addition, Trellix APIs use an API Key to meter and control usage of APIs. For more information, see Trellix Developer Portal.
GET request URL
https://api.manage.trellix.com/dpim/v2/incident?sort=actionTaken&page%5Blimit%5D=500
Request Parameters
Provide these parameters as a "body" type parameter to get the access token.
Parameter | Description | Parameter type | Data type | Required |
|---|---|---|---|---|
| Sorts the collection based on the specified attributes. Specify a prefix of '-' for sorting in descending order. | Body | String | Yes |
| The maximum value is 500, even if a higher integer as a limit is passed the maximum value is still 500. | Body | Integer | Yes |
| Specifies the starting point, the value entered need not exist. If the value doesn't exist, it starts from the nearest value. Cursor value is present in the response under 'links' as 'next' attribute, which is the marker for the next API call. | Body | String | Yes |
| Selects the set of relationships that must be shown in the result. | Body | String | Yes |
| Filters the collection of incidents using a 'joined' RSQL expression. | Body | String | Optional |
| Trace ID can be included in logs to help identify requests. It is responsible for making this unique per request or session. | Body | String | Optional |
Sample GET request URL
https://api.manage.trellix.com/dpim/v2/incident?sort=actionTaken&page%5Blimit%5D=500
Sample cURL command
curl -X 'GET' 'https://api.manage.trellix.com/dpim/v2/incident?sort=id&page%5Blimit%5D=500&include=classificationMatches' -H 'Content-Type: application/vnd.api+json' -H 'x-api-key: <apikey>' -H 'Authorization: Bearer <token>'
Response code
{
"data": [
{
"type": "incident",
"id": "string",
"links": {
"self": "string"
},
"attributes": {
"actionTaken": "string",
"agentGuid": "string",
"agentVersion": "string",
"connectivity": "string",
"destination": "string",
"eventGlobalId": "string",
"evidenceStorageId": "string",
"expectedAction": "string",
"failureReason": "string",
"incidentOrigin": "DATA_IN_MOTION",
"incidentType": "APPLICATION_FILE_ACCESS",
"insertionTime": 0,
"lastUpdateTime": 0,
"localTime": 0,
"matchUrl": "string",
"severity": "INFO",
"source": "string",
"timezone": "string",
"totalMatchCount": 0,
"utcTime": 0,
"workflowId": "string"
},
"relationships": {
"application": {
"id": "string",
"type": "application"
},
"classificationMatches": {
"id": "string",
"type": "classificationMatch"
},
"clipboard": {
"id": "string",
"type": "clipboardInfo"
},
"cloud": {
"id": "string",
"type": "cloudInfo"
},
"collaboration": {
"id": "string",
"type": "collaboration"
},
"comments": {
"id": "string",
"type": "comment"
},
"device": {
"id": "string",
"type": "deviceInfo"
},
"email": {
"id": "string",
"type": "emailInfo"
},
"endpoint": {
"id": "string",
"type": "endpoint"
},
"eventUser": {
"id": "string",
"type": "eventUser"
},
"evidence": {
"id": "string",
"type": "evidenceDetails"
},
"iamRoleReviewer": {
"id": "string",
"type": "iamRole"
},
"iamUserReviewer": {
"id": "string",
"type": "iamUser"
},
"ndlpAppliance": {
"id": "string",
"type": "ndlpApplianceInfo"
},
"networkComm": {
"id": "string",
"type": "networkCommInfo"
},
"networkShare": {
"id": "string",
"type": "networkShareInfo"
},
"policy": {
"id": "string",
"type": "policy"
},
"print": {
"id": "string",
"type": "printInfo"
},
"removableStorage": {
"id": "string",
"type": "removableStorageInfo"
},
"resolution": {
"id": "string",
"type": "resolution"
},
"rules": {
"id": "string",
"type": "rule"
},
"scan": {
"id": "string",
"type": "scanInfo"
},
"status": {
"id": "string",
"type": "status"
},
"webPost": {
"id": "string",
"type": "webPostInfo"
}
}
}
],
"included": [
{
"attributes": {},
"id": "string",
"relationships": {},
"type": "string"
}
],
"links": {
"next": "string"
}
}Status and error codes
Code | Description |
|---|---|
200 Successful | Successful response from API request. |
400 Bad request | Incorrect request parameters. |
401 Access Denied Request | API call that is unauthorized. |
403 Forbidden | Invalid API Key or lack of permission to invoke API. |
404 Not Found | Requested resource not found. |
405 Method Not Allowed | Incorrect HTTP method in API call. |
500 Internal Server Error | Error occurred on the server side during API call. |
Comparison with ePO - On-prem and Trellix DLP SaaS
ePO - On-prem fields | Trellix DLP SaaS fields | Description |
|---|---|---|
Incident | id/eventGlobalId/workflowId | Use workflowId. |
Classification Names | classificationMatches | Returns the classification and classification name when the include parameter is used with classificationMatches.classification. |
ClassificationGuids | Not available | Returns the classification id when the include parameter is used with classification. |
ClassificationMatchCounts | totalMatchCount | Returns the classification match count when the include parameter is used with classification. |
DestinationPath | Not available | Returns the destinationpath when the include parameter is used with removableStorage. |
CloudService | Cloudinfo | Returns the cloudService when the include parameter is used with cloud. |
ExternalUrl | Not available | Not available. |
EpoCorrelationId | Not available | Not available. |
UserPrincipalName | eventUser | Returns the eventUser details when the include parameter is used with eventUser. |
UserEmail | Emailinfo | Returns the eventUser details in email when the include parameter is used with eventUser. |
ClassificationsToDisplay | Not available | Returns the classification and classification details when the include parameter is used with classificationMatches. |
ActualAction | ActionTaken | No change. |
ExpectedAction | expectedAction | No change. |
InsertionTime | insertionTime/lastUpdateTime/localTime/utcTime | insertionTime is present |
ShortMatchString | Not available | Returns the matchStrings when the include parameter is used with classification. |
copyDirection | Not available | Returns the copyDirection when the include parameter is used with removableStorage. |
ExternalId | Not available | Not available. |
MachineName | endpoint | Returns the name when the include parameter is used with endpoint. |
PolicyName | policy/rules | Returns the policy data when the include parameter is used with policy. |
RuleSetName | Not available | Returns the rukeset when the include parameter is used with rules. |
EPOPolicyName | policy/rules | Returns the policy data when the include parameter is used with policy. |
StatusKey | status | Returns the status details when the include parameter is used with status. |
UserName | eventUser | Returns the eventUser details when the include parameter is used with eventUser. |
Sender | Not available | Returns the sender details when the include parameter is used with email. |
Recipients | Not available | Returns the recipient details when the include parameter is used with email. |
RecipientsCc | Not available | Returns the recipientsCc details when the include parameter is used with email. |
EmailSubject | Not available | Returns the email subject when the include parameter is used with email. |
SourceApplicationName | destination | Returns the application data when the include parameter is used with application. |
DestinationApplicationName | Not available | Returns the application data when the include parameter is used with application. |
PrinterName | printinfo | Returns the application data when the include parameter is used with print. |
USBSourcePath | Not available | Returns the sourcePath when the include parameter is used with removableStorage. |
USBDestinationPath | Not available | Returns the destinationPath when the include parameter is used with removableStorage. |
DeviceName | Not available | Returns the device name when the include parameter is used with device. |
VolumeLabel | Not available | Returns the volumeLabel when the include parameter is used with device. |
BusType | Not available | Returns the BusType when the include parameter is used with device. |
USBClass | Not available | Returns the USBClass when the include parameter is used with device. |
ActualActionStr | Not available | Not change. |