These codes describe success and error messages in a response.
When requesting only threat events, use:
https://<URL>/eventservice/api/v2/events?type=incidents
HTTP 200 — Lists all threat events generated.
This is an example of a successful response:
{
"Events": [
{
"Activities" : {
"name": "Activities",
"type": "java.lang.String",
"value": "upload"
},
"ActualAction" : {
"name" : "ActualAction",
"type" : "java.lang.String",
"value" : "BLOCK"
},
"ActualURL" : {
"name" : "ActualURL",
"type" : "java.lang.String",
"value" : "http://ocsp.digicert.com/"
},
"AllRecipients" : {
"name" : "AllRecipients",
"type" : "java.lang.String",
"value" : ""
},
"BusType": {
"name": "BusType",
"type": "java.lang.String",
"value": "USB"
},
"BrowserAddressBar" : {
"name" : "BrowserAddressBar",
"type" : "java.lang.String",
"value" : "_NOT_AVAILABLE_"
},
"CancelledAction" : {
"name" : "CancelledAction",
"type" : "java.lang.String",
"value" : "NONE"
},
"CancelledActionReason" : {
"name" : "CancelledActionReason",
"type" : "java.lang.String",
"value" : "OK"
},
"City" : {
"name" : "City",
"type" : "java.lang.String",
"value" : ""
},
"ClassDisplayName": {
"name": "ClassDisplayName",
"type": "java.lang.String",
"value": "DVD/CD-ROM drives"
},
"ClassGUID": {
"name": "ClassGUID",
"type": "java.lang.String",
"value": "{4D36E965-E325-11CE-BFC1-08002BE10318}"
},
"CloudType" : {
"name" : "CloudType",
"type" : "java.lang.String",
"value" : "BOX"
},
"Company" : {
"name" : "Company",
"type" : "java.lang.String",
"value" : ""
},
"CompatibleId" : {
"name": "CompatibleId",
"type": "java.lang.String",
"value": "SCSI\\CdRom"
},
"ConnectionDirection": {
"name": "ConnectionDirection",
"type": "java.lang.String",
"value": "INBOUND"
},
"ConnectivityState": {
"name": "ConnectivityState",
"type": "java.lang.String",
"value": "ONLINE"
},
"Country": {
"name": "Country",
"type": "java.lang.String",
"value": ""
},
"Department": {
"name": "Department",
"type": "java.lang.String",
"value": "Cobra"
},
"DestApplicationNames" : {
"name" : "DestApplicationNames",
"type" : "java.lang.String",
"value" : ""
},
"DestUserEmail" : {
"name" : "DestUserEmail",
"type" : "java.lang.String",
"value" : ""
},
"DestUserManager" : {
"name" : "DestUserManager",
"type" : "java.lang.String",
"value" : ""
},
"DestUserOU" : {
"name" : "DestUserOU",
"type" : "java.lang.String",
"value" : ""
},
"DestUserPrincipalName" : {
"name" : "DestUserPrincipalName",
"type" : "java.lang.String",
"value" : "DESKTOP-H5C82V4\\Test@"
},
"DestUserSID" : {
"name" : "DestUserSID",
"type" : "java.lang.String",
"value" : "S-1-5-21-555555555-299600114-3957220041-1001"
},
"Destination" : {
"name" : "Destination",
"type" : "java.lang.String",
"value" : "http://ocsp.digicert.com/"
},
"DestinationPath" : {
"name" : "DestinationPath",
"type" : "java.lang.String",
"value" : "c:\\programdata\\temp\\s-1-5-21-555555555-299600114-3957220041-1001\\httpoutput\\"
},
"DeviceDescription" : {
"name": "DeviceDescription",
"type": "java.lang.String",
"value": "CD-ROM Drive"
},
"DeviceId" : {
"name": "DeviceId",
"type": "java.lang.String",
"value": "5571"
},
"DeviceSerialNumber" : {
"name": "DeviceSerialNumber",
"type": "java.lang.String",
"value": "4C530001210421109265"
},
"DisplayName" : {
"name": "DisplayName",
"type": "java.lang.String",
"value": "SanDisk Cruzer Fit Media"
},
"DistinguishedName": {
"name": "DistinguishedName",
"type": "java.lang.String",
"value": "CN=dlpadmin,OU=MGMT,OU=QA,OU=HQ,DC=qamain,DC=loc"
},
"EncryptionProvider" : {
"name": "EncryptionProvider",
"type": "java.lang.String",
"value": ""
},
"Email": {
"name": "Email",
"type": "java.lang.String",
"value": ""
},
"EmailRecipients": {
"name": "EmailRecipients",
"type": "java.lang.String",
"value": "recipient@client.std.dom | recipient2@client.std.dom"
},
"EmailSender": {
"name" : "EmailSender",
"type" : "java.lang.String",
"value" : ""
},
"EmailSubject" : {
"name" : "EmailSubject",
"type" : "java.lang.String",
"value" : ""
},
"EventGlobalID" : {
"name" : "EventGlobalID",
"type" : "java.util.UUID",
"value" : "8b63404a-2c9d-48e5-adf8-f0e9b8ac34c5"
},
"EvidenceCount" : {
"name" : "EvidenceCount",
"type" : "java.lang.Integer",
"value" : "1"
},
"EvidenceFileTypeSet": {
"name": "EvidenceFileTypeSet",
"type": "java.lang.String",
"value": "text/plain"
},
"EvidenceItemType": {
"name": "EvidenceItemType",
"type": "java.lang.String",
"value": "HTTP_PAYLOAD"
},
"EvidenceNameSet" : {
"name" : "EvidenceNameSet",
"type" : "java.lang.String",
"value" : "HTTP Request Payload.txt"
},
"EvidenceSize": {
"name": "EvidenceSize",
"type": "java.lang.String",
"value": "606"
},
"EvidenceStorageId": {
"name": "EvidenceStorageId",
"type": "java.lang.String",
"value": "dp/null/dp%2FEvidences%2F"
},
"FileSystemAccess": {
"name": "FileSystemAccess",
"type": "java.lang.String",
"value": "READ_WRITE"
},
"FileSystemType" : {
"name": "FileSystemType",
"type": "java.lang.String",
"value": "HFS"
},
"HitCount": {
"name": "HitCount",
"type": "java.lang.String",
"value": "2"
},
"InstanceId": {
"name": "InstanceId",
"type": "java.lang.String",
"value": "SCSI\\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\\5&36c0e7d6&0&000000"
},
"JustificationItemID": {
"name": "JustificationItemID",
"type": "java.util.UUID",
"value": "5c3696a3-7185-4c77-b226-dba344c797c6"
},
"JustificationOption": {
"name": "JustificationOption",
"type": "java.util.UUID",
"value": "2"
},
"JustificationRevision": {
"name": "JustificationRevision",
"type": "java.lang.Integer",
"value": 10763
},
"JustificationSelectedAction": {
"name": "JustificationSelectedAction",
"type": "java.lang.String",
"value": "NONE"
},
"JustificationText": {
"name": "JustificationText",
"type": "java.lang.String",
"value": "check"
},
"Manager": {
"name": "Manager",
"type": "java.lang.String",
"value": ""
},
"ManagerManager": {
"name": "ManagerManager",
"type": "java.lang.String",
"value": ""
},
"MatchedEmailRecipients" : {
"name" : "MatchedEmailRecipients",
"type" : "java.lang.String",
"value" : ""
},
"NumberOfClassifications" : {
"name" : "NumberOfClassifications",
"type" : "java.lang.Integer",
"value" : "1"
},
"NumberOfRules" : {
"name" : "NumberOfRules",
"type" : "java.lang.Integer",
"value" : "2"
},
"OU" : {
"name": "OU",
"type": "java.lang.String",
"value": "OU=HQ,OU=MGMT,OU=QA"
},
"PlugUTCTime" : {
"name": "PlugUTCTime",
"type": "java.sql.Timestamp",
"value": "0"
},
"PolicyId" : {
"name" : "PolicyId",
"type" : "java.util.UUID",
"value" : "4277e6eb-6f3e-417b-a372-f470218c5ba2"
},
"PolicyLocator" : {
"name": "PolicyLocator",
"type": "java.lang.String",
"value": "Data_Protection_DLP/Web_DLP/DLPPolicy2"
},
"PolicyName" : {
"name" : "PolicyName",
"type" : "java.lang.String",
"value" : ""
},
"PolicyRevision" : {
"name" : "PolicyRevision",
"type" : "java.lang.Integer",
"value" : "5"
},
"PrinterName" : {
"name" : "PrinterName",
"type" : "java.lang.String",
"value" : ""
},
"RepositoryName" : {
"name": "RepositoryName",
"type": "java.lang.String",
"value": "vik-share (1)"
},
"RepositoryType" : {
"name": "RepositoryType",
"type": "java.lang.String",
"value": "CIFS"
},
"ResultClassificationNameSet" : {
"name" : "ResultClassificationNameSet",
"type" : "java.lang.String",
"value" : "Social Media"
},
"RuleNames" : {
"name" : "RuleNames",
"type" : "java.lang.String",
"value" : "Web Protection | Web Application Control"
},
"RuleSetNames" : {
"name" : "RuleSetNames",
"type" : "java.lang.String",
"value" : ""
},
"ScanName" : {
"name": "ScanName",
"type": "java.lang.String",
"value": "scan_opg"
},
"ScanID" : {
"name": "ScanID",
"type": "java.util.UUID",
"value": "0f808308-dcba-44f4-b26e-f78255bc181b"
},
"ScanRunID": {
"name": "ScanRunID",
"type": "java.util.UUID",
"value": "8e3bf350-2d5c-497f-98f8-96c82f9162af"
},
"SID": {
"name": "SID",
"type": "java.lang.String",
"value": "S-1-5-21-82242957-128552486-1918435391-1850"
},
"ScanStartTime": {
"name": "ScanStartTime",
"type": "java.sql.Timestamp",
"value": "1576601926"
},
"ScanEndTime": {
"name": "ScanEndTime",
"type": "java.sql.Timestamp",
"value": "1576601971"
},
"ScanErrorCount": {
"name": "ScanErrorCount",
"type": "java.lang.Integer",
"value": 0
},
"ScanIncidentCount": {
"name": "ScanIncidentCount",
"type": "java.lang.Integer",
"value": 1
},
"ScanItemCount": {
"name": "ScanItemCount",
"type": "java.lang.Integer",
"value": 1
},
"ScanRecordCount": {
"name": "ScanRecordCount",
"type": "java.lang.Integer",
"value": 1
},
"ScanThreshold": {
"name": "ScanThreshold",
"type": "java.lang.Integer",
"value": 0
},
"ScanType": {
"name": "ScanType",
"type": "java.lang.String",
"value": "LOCAL_DRIVES"
},
"ScanUserName": {
"name": "ScanUserName",
"type": "java.lang.String",
"value": "BTuttle"
},
"Source": {
"name": "Source",
"type": "java.lang.String",
"value": "ldap://ad.mcafee.com:389/"
},
"SourceDisplayName": {
"name": "SourceDisplayName",
"type": "java.lang.String",
"value": "dlpadmin"
},
"SourcePath" : {
"name" : "SourcePath",
"type" : "java.lang.String",
"value" : "c:\\programdata\\temp\\s-1-5-21-5555555555-299600114-3957220041-1001\\httpoutput\\htp8d82.tmp"
},
"SourceUsername": {
"name": "SourceUsername",
"type": "java.lang.String",
"value": "QAMAIN\\dlpadmin"
},
"Status": {
"name": "Status",
"type": "java.lang.String",
"value": "ENDED"
},
"StoreFile" : {
"name" : "StoreFile",
"type" : "java.lang.Boolean",
"value" : "true"
},
"TargetUsername" : {
"name" : "TargetUsername",
"type" : "java.lang.String",
"value" : ""
},
"TimeZone" : {
"name" : "TimeZone",
"type" : "java.lang.String",
"value" : "Paris, Madrid (heure d’été)"
},
"Title" : {
"name" : "Title",
"type" : "java.lang.String",
"value" : ""
},
"TotalContentSize" : {
"name" : "TotalContentSize",
"type" : "java.lang.Integer",
"value" : "0"
},
"TotalMatches" : {
"name" : "TotalMatches",
"type" : "java.lang.Integer",
"value" : "0"
},
"TotalUnique" : {
"name" : "TotalUnique",
"type" : "java.lang.Integer",
"value" : "1"
},
"UniqueCount": {
"name": "UniqueHitCount",
"type": "java.lang.String",
"value": "2"
},
"UnplugUTCTime" : {
"name": "UnplugUTCTime",
"type": "java.sql.Timestamp",
"value": "0"
},
"USBClass": {
"name": "USBClass",
"type": "java.lang.String",
"value": "8"
},
"UserPrincipalName": {
"name": "UserPrincipalName",
"type": "java.lang.String",
"value": "DESKTOP-7FD20MC\\Daman@"
},
"VendorId": {
"name": "VendorId",
"type": "java.lang.String",
"value": "0781"
},
"VolumeLabel": {
"name": "VolumeLabel",
"type": "java.lang.String",
"value": "Cruzer"
},
"VolumeSerialNumber": {
"name": "VolumeSerialNumber",
"type": "java.lang.String",
"value": "2650813282"
},
"agentguid" : {
"name" : "agentguid",
"type" : "java.util.UUID",
"value" : "90323402-8dd2-4b18-83b2-82525c74a993"
},
"analyzer" : {
"name" : "analyzer",
"type" : "java.lang.String",
"value" : "EPOEvent"
},
"analyzerdatversion" : {
"name" : "analyzerdatversion",
"type" : "java.lang.String",
"value" : "5"
},
"analyzerengineversion" : {
"name" : "analyzerengineversion",
"type" : "java.lang.String",
"value" : "11.5.0.40"
},
"analyzerhostname" : {
"name" : "analyzerhostname",
"type" : "java.lang.String",
"value" : "DESKTOP-H5C82V4"
},
"analyzeripv4" : {
"name" : "analyzeripv4",
"type" : "java.lang.Integer",
"value" : "749080748"
},
"analyzeripv6" : {
"name" : "analyzeripv6",
"type" : "[B",
"value" : "AAAAAAAAAAAAAP//rBCmLA=="
},
"analyzerversion" : {
"name" : "analyzerversion",
"type" : "java.lang.String",
"value" : "11.5.0.40"
},
"autoguid" : {
"name" : "autoguid",
"type" : "java.util.UUID",
"value" : "6df8f9a7-0a5a-426c-bbfd-f19217e9ee28"
},
"autoid" : {
"name" : "autoid",
"type" : "java.lang.Long",
"value" : "118"
},
"destinationproxy": {
"name": "destinationproxy",
"type": "java.lang.Integer",
"value": 1084752129
},
"detectedutc" : {
"name" : "detectedutc",
"type" : "java.sql.Timestamp",
"value" : "1585599353000"
},
"eventtimelocal" : {
"name" : "eventtimelocal",
"type" : "java.sql.Timestamp",
"value" : "1585606553000"
},
"nodepath" : {
"name" : "nodepath",
"type" : "java.lang.String",
"value" : "1\\464\\466"
},
"parent_guid": {
"name": "parent_guid",
"type": "java.util.UUID",
"value": "de8d3996-3613-4716-9c45-215d4fa5f573"
},
"rawmac" : {
"name" : "rawmac",
"type" : "java.lang.String",
"value" : "000C29AF7D63"
},
"receivedutc" : {
"name" : "receivedutc",
"type" : "java.sql.Timestamp",
"value" : "1585600322000"
},
"reportingproduct" : {
"name" : "reportingproduct",
"type" : "java.lang.String",
"value" : "REPORTING_PRODUCT_DLP_FOR_WINDOWS"
},
"shortMatchString": {
"name": "shortMatchString",
"type": "java.lang.String",
"value": "...best fits your document. <match>test</match> To make your document lo..."
},
"sourceipv4" : {
"name" : "sourceipv4",
"type" : "java.lang.Integer",
"value" : "749080748"
},
"sourceproxy": {
"name": "sourceproxy",
"type": "java.lang.Integer",
"value": 1084752129
},
"sourceurl" : {
"name" : "sourceurl",
"type" : "java.lang.String",
"value" : "_NOT_AVAILABLE_"
},
"targetfilename" : {
"name" : "targetfilename",
"type" : "java.lang.String",
"value" : "c:\\program files\\mozilla firefox\\firefox.exe"
},
"targetipv4" : {
"name" : "targetipv4",
"type" : "java.lang.Integer",
"value" : "749080748"
},
"targetport" : {
"name" : "targetport",
"type" : "java.lang.Long",
"value" : "0"
},
"targetprocessname" : {
"name" : "targetprocessname",
"type" : "java.lang.String",
"value" : "firefox"
},
"targetprotocol" : {
"name" : "targetprotocol",
"type" : "java.lang.String",
"value" : "PO_NETWORK_PROTOCOL_TYPE_DEFAULT"
},
"tenantguid" : {
"name" : "tenantguid",
"type" : "java.lang.String",
"value" : "E12FBBEB-6FEF-40F8-A737-E44B5E49FC77"
},
"tenantid" : {
"name" : "tenantid",
"type" : "java.lang.Long",
"value" : "118"
},
"threatactiontaken" : {
"name" : "threatactiontaken",
"type" : "java.lang.String",
"value" : "PO_ACTION_BLOCK"
},
"threateventid" : {
"name" : "threateventid",
"type" : "java.lang.Integer",
"value" : "19114"
},
"threatname" : {
"name" : "threatname",
"type" : "java.lang.String",
"value" : "Web Protection, Web Application Control"
},
"threatseverity" : {
"name" : "threatseverity",
"type" : "java.lang.Byte",
"value" : "3"
},
"threattype" : {
"name" : "threattype",
"type" : "java.lang.String",
"value" : "OUTGOING_HTTP"
}
},
{
. . .
}
],
"type": "incidents"
}HTTP 400 — Bad request. The request parameters or format might be invalid.
HTTP 401 — Unauthorized access.
HTTP 403 — Forbidden.