Gets details for a single alert.
GET https://<address>/wsapis/[v1.2.0|v2.0.0]/alerts/alert/<alert_id>
Availability
This command is available on the following appliances:
Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security
Required headers:
X-FeApi-Token: [API-Token] X-FeClient-Token: [Client-Token] Accept: application/xml
Parameters
address—The IP address of the appliance running the Web Services API.alert_ID—The infection ID. You must also specify the Alert-Type.API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token—(Optional) This client token is provided by Trellix. For more information about the client token, contact your sales representative.
Example request
GET https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/alerts/alert/4790
Request headers:
X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx X-FeClient-Token: BigDataInc Accept: application/json
Alert details response
HTTP/1.1 [Response Code] [Response Message] Date: [Date] HTTP/1.1 200 OK Date: Tue, 14 May 2019 22:17:56 GMT Content-Type: application/xml <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <alerts appliance="eMPS" version="eMPS (eMPS) 8.3.0.852440" msg="concise" xmlns="http://www.fireeye.com/alert/2014/AlertSchema"> <ns2:alert appliance-id="002590867AAA" id="4790" name="malware-object" severity="majr" uuid="b435583b-1c23-4a80-b893-203245073ed4" ack="no" product="Email MPS" vlan="0" malicious="yes" sc-version="866.106"> <ns2:explanation> <ns2:malware-detected> <ns2:malware name="Malware.Binary"> <ns2:md5sum>5e747bddd6a759b0a591ab4bb3b5254b</ns2:md5sum> <ns2:sha256>cfbb1006d9e6c2660b4876fecef9789c1a3ac0c807181277a2778c59d9b8675f</ns2:sha256> </ns2:malware> </ns2:malware-detected> </ns2:explanation> <ns2:src> <ns2:smtp-mail-from>testuser1@aedev.com</ns2:smtp-mail-from> </ns2:src> <ns2:alert-url>https://camelback-sunil-ex.eng.fireeye.com/emps/eanalysis?e_id=5116&type=attch</ns2:alert-url> <ns2:action>blocked</ns2:action> <ns2:occurred>2019-05-14T20:53:44.722Z</ns2:occurred> <ns2:dst> <ns2:smtp-to>testuser2@aedev.com</ns2:smtp-to> </ns2:dst> <ns2:smtp-message> <ns2:subject>Test Email</ns2:subject> </ns2:smtp-message> </ns2:alert> </alerts>
Response fields
Response Code—A standard HTML response code.
200—Request successful.
4xx—Request unsuccessful because unknown or invalid fields were included in the input.
5xx—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
Empty—Request successful.
Invalid Client Request—Request unsuccessful because unknown or invalid fields were included in the input.
Server encountered a problem...retry later—Request unsuccessful because the server encountered a problem.
Date—Standard HTML date format.
alert fields—The fields returned vary depending on the alert. See the Alert Notifications reference guide for descriptions of available fields.
Example response
HTTP/1.1 200 OK Date: Tue, 14 May 2019 22:17:56 GMT Content-Type: application/xml <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <alerts appliance="eMPS" version="eMPS (eMPS) 8.3.0.852440" msg="concise" xmlns="http://www.fireeye.com/alert/2014/AlertSchema"> <ns2:alert appliance-id="002590867AAA" id="4790" name="malware-object" severity="majr" uuid="b435583b-1c23-4a80-b893-203245073ed4" ack="no" product="Email MPS" vlan="0" malicious="yes" sc-version="866.106"> <ns2:explanation> <ns2:malware-detected> <ns2:malware name="Malware.Binary"> <ns2:md5sum>5e747bddd6a759b0a591ab4bb3b5254b</ns2:md5sum> <ns2:sha256>cfbb1006d9e6c2660b4876fecef9789c1a3ac0c807181277a2778c59d9b8675f</ns2:sha256> </ns2:malware> </ns2:malware-detected> </ns2:explanation> <ns2:src> <ns2:smtp-mail-from>testuser1@aedev.com</ns2:smtp-mail-from> </ns2:src> <ns2:alert-url>https://test39-ex.eng.fireeye.com/emps/eanalysis?e_id=5116&type=attch</ns2:alert-url> <ns2:action>blocked</ns2:action> <ns2:occurred>2019-05-14T20:53:44.722Z</ns2:occurred> <ns2:dst> <ns2:smtp-to>testuser2@aedev.com</ns2:smtp-to> </ns2:dst> <ns2:smtp-message> <ns2:subject>Test Email</ns2:subject> </ns2:smtp-message> </ns2:alert> </alerts>