REST API call to retrieve events of the type incidents using Events API

The Events GET API provides read access to threat events available in ePO - SaaS.

GET request URL

Use this link if your account is the US region

https://arevents.manage.trellix.com/eventservice/api/v2/events?type=incidents

Use this link if your account is the EU region

https://areventsfrk.manage.trellix.com/eventservice/api/v2/events?type=incidents

Request Parameters

You can use these parameters in the Events API request.

Parameter	Description	Parameter type	Data type	Required	Default
`Authorization`	Trellix IAM-based access token. The token must include one of these combinations of scopes: `epo.admin` — Allows user to access threat events `epo.evt.r` — Allows user to access threat events ONLY `dp.im.r` — Allows user to access threat events `epo.evt.r dp.im.r` — Allows user to access threat events for data loss prevention.	Header	String	True	N/A
`type`	Defines the type of events or incidents requested. The allowed values are: `threats` — Returns threat events ONLY, if available. `incidents` — Returns Trellix DLP – SaaS events of the type incidents ONLY, if available. `all` — Returns threat events and Trellix DLP – SaaS threat events, if available.	Query	String	True	N/A
`since`	The date and time of the earliest events or incidents to return with the response.	Query	Date	False	1970-01-01T00:00:00.000Z
`until`	The date and time of the latest events or incidents to return with the response.	Query	Date	False	Current date and time when query is executed.
`sort`	Retrieving events or incidents, sorted by date and time. Values can be `desc` or `asc`.	Query	String	False	desc
`limit`	The maximum number of events or incidents returned in the response. Must be an integer value between 1–1000. Note In some cases, the requested number of events may be reduced to prevent time-out issues.	Query	Number	False	100
`after`*	A link returned in the HTTP header (rel=next), providing the cursor that points to the end of the page of data that has been returned. Used to get the next results, if available. Returns a time stamp value which is base64 encoded. Decode it to get actual stamp value and use it with `after`.	Query	String	False	N/A

* For more information about using the after parameter, see Process incidents with the after parameter.

Sample GET request URL

https://arevents.manage.trellix.com/eventservice/api/v2/events?type=incidents

Sample cURL command

curl -X GET 'https://arevents.manage.trellix.com/eventservice/api/v2/events?since=<since_date>&until=<until_date>&sort=asc&limit=10' -H 'Authorization: Bearer <Access_Token>' -H 'cache-control: no-cache'

Response codes

These codes describe success or error messages in a response to Events API. HTTP 200 — Lists all threat events generated. For a sample response code, see Response code for Events API .

Status and error codes

List of HTTP status codes returned for the query.

Code	Description
200 OK	Lists all threat events generated.
400 Bad request	The request parameters or format might be invalid.
401 Unauthorized	Unauthorized access.
403 Forbidden	Forbidden.