Alerts updated with ATI details request

Retrieves the IDs of alerts that have been updated with ATI information since a given time.

GET https://<address>/wsapis/v1.2.0/ati/<alert_type>?start_time=<from_date>

Note

The 2.0.0 version of this API is deprecated in 2019.02.

Headers:

X-FeApi-Token: [API-Token]

X-FeClient-Token: [Client-Token]

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security

Parameters

address—The IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
Client-Token (Optional)— This client token is provided by Trellix. For more information about the client token, contact your sales representative.
alert_type—Specify the alert type using the alert_type option:
Alert Type
alert_type
Malware object
malwareobject
from-date (Optional)—Specifies a start time. Use the following format:
start_time="yyyy-MM-ddTHH:mm:ss.SSSXXX" or
start_time="yyyy-MM-ddTHH:mm:ssXXX"
- yyyy—Year (1900 and later)
- MM—Month (01-12)
- dd—Day (01-31)
- HH—Hour (01-24)
- mm—Minutes (01-59)
- ss.SSS or ss—Seconds (01-59.999)
- XXX or XX:XX—Time offset from UTC.
For example: start_time="2018-07-04T12:08:56.235-07:00" or
start_time="2018-07-04T12:08:56.235-07"

Alert Type	alert_type
Malware object	`malwareobject`

Note

If you do not include a start time with your request, the system defaults to the past 12 hours.

Example request

GET https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/ati/malwareobject?start_time=2018-01-24T16:30:00.000-07:00

Alerts updated with ATI details response

HTTP/1.1 [Response Code] [Response Message]
Date: [Date]
[Result Data]

Response fields

Response Code—A standard HTML response code.
- 200—Request successful.
- 401—Request unsuccessful because the session token was incorrect.
Response Message—A standard HTML response message.
- OK—Request successful.
- Unauthorized—Request unsuccessful because the session token was incorrect.
Date—Standard HTML date format.
Results Data—A list of alert IDs.

Example

HTTP/1.1 200 OK

Date: Mon, 17 Nov 2018 08:00:00 GMT

{"rawType":"com.fireeye.v110.rest.model.UpdatedInfIdRestModel",
"type":"com.fireeye.v110.rest.model.RestModelBase",
"entity":{"infIdList":[19849450, 14646770,20446085,20532909,20472984,
20264571,20264487,20222885,20214377,20059086,20011544,19961329,
19956463,19954394,19928265,19555190,19555999,15695625,16107393,
17043339,17228593,18519689,18863297,19951882,15695588,20486862,
20515961,20499506,20499229,20496310,20487352,20484363,20482195,
20479242,20477862,20444726,20434507,20432057,20393762,20337219,
20316793,20301927,20295564,20279219,20277420,20274796,20273790,
20260605,2025783

...

cURL code sample: retrieving a list of recently updated alerts

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --no-progress-bar 
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" 
--header "Accept: application/json" 
"https://xxx.xxx.xxx.xxx/wsapis/v1.2.0/ati/
malwareobject?start_time=2018-11-24T16:30:00.000-07:00"

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
--no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in response to your authentication request.
Note
By default, the X-FeApi-Token times out after 15 minutes of inactivity.

--header "Accept: application/json"—This option specifies that the request is in JSON format.
https://xxx.xxx.xxx.xxx/wsapis/v1.2.0/ati/malwareobject?start_time=2018-11-24T16:30:00.000-07:00—The ATI request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. Replace malwareobject with the alert type of interest. Replace 2018-11-24T16:30:00.000-07:00 with the appropriate start time.

Results

A list of alert IDs that have been updated with ATI information since the start time is returned.