Press CTRL+K to open search

Report by time request

  • Published on Sep 3, 2026
  • 11 minute(s) read
Prev Next

Returns reports on selected alerts by specifying a time_frame value or a start_time and end_time of the search range.

Availability

This command is available on the following appliances:

  • Central Management System

  • Malware Analysis

  • Email Security — Server

  • File Protect

  • Network Security

The following syntax can be used to request a report:

Report request using a specified time frame

GET https://<cm_address>/wsapis/v1.2.0/reports/report?report_type=<reportName>&type=<reportType> &time_frame=<timeFrame>&limit=<limit>&interface=<interface>

Header:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Report request using a start and end time

https://<cm_address>/wsapis/v1.2.0/reports/report?report_type=<reportName>&time_frame=between &type=<reportType>&start_time=<start_time>&end_time=<end_time>

Header:

X-FeApi-Token: [API-Token]
X-FeClient-Token: [Client-Token]

Note

If you do not include a time frame or start and end time with your request, the system defaults to the pastWeek time frame.

Parameters

  • cm_address—This is the IP address of the Central Management System appliance running the Web Services API.

  • API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.

  • Client-Token (Optional)— This client token is provided by Trellix. For more information about the client token, contact your sales representative.

  • Report Type—Specify the report type using the report_type option and the output type using the type option:

Report

report_type

type

Series

FX Series Executive Summary

fmpsFileExecutiveSummary

pdf

FX

Email Antivirus Report

empsEmailAVReport

csv

EX

Email Activity Report

empsEmailActivity

pdf

EX

Email Executive Summary

empsEmailExecutiveSummary

pdf

EX

Email Hourly Status

empsEmailHourlyStat

csv

EX

Website Callback Server Report

mpsCallBackServer

csv

NX

Website Executive Summary

mpsExecutiveSummary

pdf

NX

Website Infected Host Trends

mpsInfectedHostsTrend

csv

NX

Website Malware Activity

mpsMalwareActivity

csv or pdf

NX

Website Antivirus Report

mpsWebAVReport

csv

NX

IPS Executive Summary Report

ipsExecutiveSummary

csv or pdf

NX

IPS Top N Attacks Report

ipsTopNAttack

csv or pdf

NX

IPS Top N Attackers Report

ipsTopNAttacker

csv or pdf

NX

IPS Top N Victims Report

ipsTopNVictim

csv or pdf

NX

IPS Top N MVX-Correlated Report

ipsTopNMvxVerified

csv or pdf

NX

Alert Details Report

alertDetailsReport

pdf

NX

Requests for ipsTopNAttack, ipsTopNAttacker, ipsTopNVictim, or ipsTopNMvxVerified reports must be used with the limit parameter set to either 25, 50, 75, or 100.

Note

You must have an Intrusion Prevention System (IPS) enabled appliance to be able to generate the IPS reports.

Time frame (optional)

Specify a time frame:

Time Frame

Description

start_time

Searches between two specified time frames. When specifying a start_time value, you must specify both a start_time and an end_time value. Follow the format:

Syntax: start_time=<start_time>&end_time=<end_time>

Where both the start time and end time follow the format:

start_time="yyyy-MM-ddTHH:mm:ss.SSSXXX" or start_time="yyyy-MM-ddTHH:mm:ssXXX"

  • yyyy—Year (1900 and later)

  • MM—Month (01-12)

  • dd—Day (01-31)

  • HH—Hour (01-24)

  • mm—Minutes (01-59)

  • ss.sss—Seconds (01-59.999)

  • XX:XX—Time offset from UTC.

Example: start_time="2001-07-04T12:08:56.235-07:00" or start_time="2001-07-04T12:08:56.235-07"

end_time

Searches between two specified time frames. When specifying an end_time value, you must specify both a start_time and an end_time value. Follow the format:

Syntax: end_time=<start_time>&end_time=<end_time>

Where both the start time and end time follow the format:

end_time="yyyy-MM-ddTHH:mm:ss.SSSXXX" or end_time="yyyy-MM-ddTHH:mm:ssXXX"

  • yyyy—Year (1900 and later)

  • MM—Month (01-12)

  • dd—Day (01-31)

  • HH—Hour (01-24)

  • mm—Minutes (01-59)

  • ss.sss—Seconds (01-59.999)

  • XX:XX—Time offset from UTC.

Example: end_time="2001-07-04T12:08:56.235-07:00" or end_time="2001-07-04T12:08:56.235-07"

pastWeek

Searches the past week.

pastMonth

Searches the past month.

pastThreeMonth

Searches the past three months.

between

Searches between two times.

today

Searches today.

oneDayAgo

Searches the past day.

twoDaysAgo

Searches the past two days.

threeDaysAgo

Searches the past three days.

fourDaysAgo

Searches the past four days.

fiveDaysAgo

Searches the past five days.

sixDaysAgo

Searches the past six days.

pastHour

Searches the past hour.

pastDay

Searches the past day.

  • Limit—This option is required only for IPS “Top N” reports. The limit option sets the maximum number (N) of items covered by each report.

  • Interface—This option is required only for IPS reports. The interface option sets the Internet interface to one of the following values:

    • A

    • B

    • AB

  • Infection ID and Infection Type (Optional)—Use the combination of infection_id and infection_type options to specify a unique alert to describe in the Alert Details Report. If one option is used alone and does not specify a unique alert, an error message is produced. The following infection types are supported:

    • malware-object

    • malware-callback

    • infection-match

    • domain-match

    • web-infection

    To obtain the infection ID and infection type, submit an alert request.

  • ID (Optional)—The id option is an alternative to the infection_id and infection_type options. Specify a unique ID using the internal database unique ID of the alert record.

Example request

https://<cm_address>/wsapis/v1.2.0/reports/
report?report_type=empsEmailAVReport&time_frame=between&type=csv&start_time="2001-07-04T12:08:56.235-07"&end_time="2001-09-04T12:08:56.235-07"

cURL code sample: generating a report

The following code sample can be copied and executed from any command-line interface that includes the cURL library. This sample builds on the authentication cURL code sample.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSkH --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/report?report_type=empsEmailHourlyStat

This cURL sample includes the following options:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • -H—This option allows you to specify a custom header with the --header switch.

  • --no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in response to your authentication request.

    Note

    By default, the X-FeApi-Token times out after 15 minutes of inactivity.

  • https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/report?report_type=empsEmailHourlyStat—The report request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. The report_type=empsEmailHourlyStat will return a .csv file.

Results

An Email Hourly Status report in CSV format is returned inline.

cURL code sample: finding the infection type and infection ID

To obtain the infection type and infection ID of an alert, submit an alert request. An alert request returns the infection type and infection ID of all alerts that match your filters.

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSkH --no-progress-bar
--header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/alerts?duration=1_hour

This cURL sample includes the following options:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • -H—This option allows you to specify a custom header with the --header switch.

  • --no-progress-bar—This option suppresses the cURL download progress bar, which can interfere with the request.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in the response to your authentication request.

    Note

    By default, the X-FeApi-Token times out after 15 minutes of inactivity.

  • https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/alerts?duration=1_hour—The alert request. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. In this example, the alerts?duration=1_hour filter returns alerts that were detected in the previous hour.

Results

The infection type and infection ID of all alerts that match your filters are returned.

Alert ID response

Look for the line with alert id="8351" name="malware-object" in the following example to find the infection ID and the infection type.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<alerts appliance="CMS" version="CMS (CMS) 7.4.0.239904" msg="concise" xmlns:ns2="http://www.fireeye.com/alert/2013AlertSchema">
<ns2:alert id="8351" name="malware-object" severity="majr" product="Web MPS" sensor="wmps4">
        <ns2:explanation>
            <ns2:malware-detected>
                <ns2:malware name="Trojan.Downloader">
                    <ns2:md5sum>2c72f5572741eab4d47afa5d3575b7b8</ns2:md5sum>
                </ns2:malware>
            </ns2:malware-detected>
        </ns2:explanation>
        <ns2:src>
            <ns2:ip>xxx.xxx.xxx.xxx</ns2:ip>
        </ns2:src>
        <ns2:alert-url>https://localhost:8080/botnets/events_for_bot?ma_id=8351</ns2:alert-url>
        <ns2:action>notified</ns2:action>
        <ns2:occurred>2014-08-06T18:00:44.467Z</ns2:occurred>
        <ns2:dst>
            <ns2:port>123</ns2:port>
            <ns2:ip>xxx.xxx.xxx.xxx</ns2:ip>
        </ns2:dst>
    </ns2:alert>
</alerts>
Response fields

  • Response Code—A standard HTML response code.

    • 200—Request successful.

    • 400—Request unsuccessful because the filter value was invalid.

    • 500—Request unsuccessful because the server encountered a problem.

  • Response Message—A standard HTML response message.

    • OK—Request successful.

    • Bad Request—Request unsuccessful because the filter value was invalid.

    • Internal Server Error—Request unsuccessful because the server encountered a problem.

cURL code sample: generating a report for a unique alert

Use the infection ID and infection type in a report request to get details about a specific alert.

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSkH --no-progress-bar --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/ report?report_type=alertDetailsReport&infection_id=8351&infection_type=malware-object"

This cURL sample includes the following options:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • -H—This option allows you to specify a custom header with the --header switch.

  • --no-progress-bar—This option suppresses the cURL download progress bar. This progress bar can interfere with the request.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in response to your authentication request.

    Note

    By default, the X-FeApi-Token times out after 15 minutes of inactivity.

  • "https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/report?report_type=alertDetailsReport&infection_id=8351&infection_type=malware-object"—The report request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. The generated Alert Details Report will provide details of a malware object with an infection ID of 8351.

Results

The requested report is returned inline as unformatted data. You need to redirect the output to a PDF file to see a formatted version.

cURL code sample: specifying the location of the generated report

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --no-progress-bar --header "Accept: application/pdf" --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" "https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/ report?report_type=alertDetailsReport&infection_id=6713675&infection_type=malware-object" -o ./results_pdf/wso.report.6713675.pdf

This cURL sample includes the following options:

  • -q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.

  • -g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.

  • -s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.

  • -S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.

  • -k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.

  • --no-progress-bar—This option suppresses the cURL download progress bar. This progress bar can interfere with the request.

  • --header "Accept: application/pdf"—This option specifies a PDF version of the report.

  • --header "X-FeApi-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"—This custom header provides the API-Token that was returned during the authentication request. In the authentication cURL code sample, this token was included in the auth.txt file. Replace the token value in the code sample with the token value received in the response to your authentication request.

    Note

    By default, the X-FeApi-Token times out after 15 minutes of inactivity.

  • "https://xxx.xxx.xxx.xxx:443/wsapis/v1.2.0/reports/report?report_type=alertDetailsReport&infection_id=6713675&infection_type=malware-object"—The report request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance. The generated Alert Details Report will provide details of a malware object with an infection ID of 6713675.

  • -o—This option redirects the output to a file.

  • ./results_pdf/wso.report.6713675.pdf—This path specifies where the generated report will be saved.

Results

The requested report is saved to the specified path.

:
Related articles
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved