Query quarantined email request

Returns a list of quarantine documents given a query filter. The data is sorted in descending order (newest first). This provides the same functionality as the 'Quarantine' tab of the Email Security — Cloud Admin Console. Traffic type defaults to inbound. To handle outbound traffic, set the traffic_type parameter to outbound. Examples of requests and responses for inbound and outbound traffic are included in this section.

POST https://<etp_instance_addr>/api/v1/quarantine/

Required headers:

x-fireeye-api-key: <key>—Specifies your personal API key.

Content-Type: “application/json”—Content-type of the request body.

Request body:

{
  "attributes: {
    "reason": ["string", "string"],
    "from": "email_address",
    "domains": ["domain1", "domain1"],
    "domain_groups": ["domain_group1", "domain_group2"],
    "recipients": ["email_address1", "email_address2"],
    "email_server": "IP_address",
    "tags": { 
      "value": ["tag"]
  },
    "sender_domain": "domain",
    "date": {
      "from_date": "date",
      "to_date": "date"
    }
    "subject": "string"
  }
  "size": int
}

The query parameters should be nested inside "attributes" as shown. To get only a subset of the result hits, use the optional "size" parameter.

All parameters are optional. Any number of these fields can be used in any combination. At minimum, a blank JSON document, {}, should be passed for unfiltered results (within the domain of the API Key used).

Options

Parameters:

Scroll support:

Scrolling is supported on the field "timestamp_quarantine". In the "meta" section, it contains the value of this field in the last document of the "data" array, which can be used by the user for implementing scrolling functionality. You can use this value in the "date"."to_date" field in query for the next page.

Example of an inbound request

POST https://<etp_instance_addr>/api/v1/quarantine/ -H 'x-fireeye-api-key: <APIKEY>' -d '

Example of an outbound request

POST https://<etp_instance_addr>/api/v1/quarantine/-H 'x-fireeye-api-key: <APIKEY>' -d '{"traffic_type":"outbound", "attributes": {"reason": ["Spam"]}}'

Example request body

Field values are for illustration only.

    {
        "attributes": {
            "reason": ["Spam"],
            "from": "robot11@deny.robot.com",
            "domains": ["test900.etp-testdomain5.com", "test901.etp-testdomain5.com"],
            "recipients": ["usera@test900.etp-testdomain5.com", "usera@test901.etp-testdomain5.com"],
            "email_server": "10.128.22.230",
            "sender_domain": "deny.robot.com",
            "date": {
                "from_date": "2018-12-26T00:00:00.000000",
                "to_date": "2018-12-28T00:00:00.000000"
            },
            "subject": "Test Email",
            "source": ["active"],
            "tags": {
                "value":["impersonation"]
            },
        },
        "size": 20
    }
'

Query quarantined email response

In this example, the query filters satisfy 9 results (indicated by the "total" field inside the "meta" section of output, out of which the API returned 2 records in the "data" section (the array returned contains 2 documents). The data is sorted in descending order (newest first) of the field "timestamp_quarantine".

{
     "data": [

        ...

       {
          "domain": "test900.etp-testdomain5.com",
          "attachments": [],
          "cc": [""],
          "sender_domain": "deny.robot.com",
          "is_marked_deleted": 0,
          "country_code": "XX",
          "message": "",
          "subject": "Test Email",
          "verdict_as": "FAIL",
          "from": "robot11@deny.robot.com",
          "verdict_av": "PASS",
          "verdict_pv": "PASS",
          "domain_id": 1120750,
          "to": [
                 "usera@test900.etp-testdomain5.com"
          ],
          "timestamp_quarantine": "2018-12-28T00:00:00.000",
          "message_id": "86334999702C232C5be1a5c96",
          "recipients": [
                 "usera@test900.etp-testdomain5.com"
           ],
          "is_read": 0,
          "released": [{
          "email_id": "usera@test900.etp-testdomain5.com",
          "is_released": 0,
          "key": "fc074e718240487d94276fbb9eb65252"
          }],
          "timestamp_sent": "2018-12-28T00:00:00.000",
          "is_under_release": 0,

          "tags": ["impersonation"],

          "source": "active",
          "sender_ip": "10.128.22.230",
          "client_tag": "QA_CLIENT_2"
          },

       ],
    "meta": {

    "size": 20,
    "total": 81,
    "timestamp_quarantine": "2018-12-28T00:00:00.000",
    "copyright": "Copyright 2019 Fireeye Inc",
  }
}

cURL code example: query quarantined email

curl -XPOST https://<APIURI>/quarantine/ -H 'x-fireeye-api-key: xxxxxxxxxxxxxxx' -d '
 {
  "attributes": {
    "reason": ["Spam", "Virus"],
    "from": "Frest_ghxkviaxxc_emailtrace@musubi2.etp-testdomain5.com",
    "domains": ["test900.etp-testdomain5.com", "test901.etp-testdomain5.com"],
    "recipients": ["usera@test900.etp-testdomain5.com", "usera@test901.etp-testdomain5.com"],
    "email_server": "10.128.22.230",
    "sender_domain": "musubi2.etp-testdomain5.com",
    "date": {
      "from_date": "2019-08-26T00:00:00.000000",
      "to_date": "2019-08-28T00:00:00.000000"
    },
    "subject": "Test Email"
  },
  "size": 2
}
'

This cURL sample includes the following options: