⚠️ Start Enriched Events Facet Job

POST {{cb_url}}/api/investigate/v2/orgs/{{cb_org_key}}/enriched_events/facet_jobs

Creates an enriched events facet job. The results for the facet job may be requested using the job ID returned. This route will not request processes.

RBAC Permissions Required

Permission (.notation name)Operation(s)
threathunter.eventsREAD

See the Documentation

Request Body

{"query"=>"(event_id:{{cb_event_id}})", "terms"=>{"fields"=>["event_type", "process_name", "process_effective_reputation", "process_hash", "device_name", "process_username", "parent_effective_reputation", "ttp", "netconn_location"], "rows"=>50, "time_range"=>{"start"=>"2020-05-01T14:48:03-07:00"}, "start"=>"2020-05-01T14:48:03-07:00"}}

HEADERS

KeyDatatypeRequiredDescription
Content-Typestring