Qodex.ai

Export Threats

GET {{baseUrl}}/web/api/v2.1/threats/export?k8sNodeName__contains=ex&filePath__contains=ex&analystVerdictsNin=ex&confidenceLevelsNin=ex&agentIds=ex&createdAt__gte=ex&incidentStatusesNin=ex&initiatedByUsername__contains=ex&classificationsNin=ex&k8sPodName__contains=ex&k8sNamespaceLabels__contains=ex&agentIsActive=ex&updatedAt__gte=ex&detectionEnginesNin=ex&k8sNamespaceName__contains=ex&osTypesNin=ex&noteExists=ex&tenant=ex&resolved=ex&rebootRequired=ex&detectionAgentDomain__contains=ex&engines=ex&externalTicketExists=ex&updatedAt__gt=ex&agentVersions=ex&contentHash__contains=ex&k8sControllerName__contains=ex&collectionIds=ex&updatedAt__lte=ex&k8sPodLabels__contains=ex&siteIds=ex&groupIds=ex&threatDetails__contains=ex&detectionAgentVersion__contains=ex&accountIds=ex&mitigationStatuses=ex&containerImageName__contains=ex&agentMachineTypesNin=ex&contentHashes=ex&originatedProcess__contains=ex&publisherName__contains=ex&containerLabels__contains=ex&createdAt__lte=ex&classifications=ex&confidenceLevels=ex&ids=ex&initiatedBy=ex&externalTicketId__contains=ex&agentVersionsNin=ex&externalTicketIds=ex&osTypes=ex&displayName=ex&storylines=ex&storyline__contains=ex&query=ex&pendingActions=ex&k8sClusterName__contains=ex&initiatedByNin=ex&detectionEngines=ex&enginesNin=ex&osNamesNin=ex&incidentStatuses=ex&createdAt__gt=ex&updatedAt__lt=ex&createdAt__lt=ex&mitigatedPreemptively=ex&failedActions=ex&realtimeAgentVersion__contains=ex&k8sControllerLabels__contains=ex&uuid__contains=ex&analystVerdicts=ex&countsFor=ex&containerName__contains=ex&classificationSourcesNin=ex&commandLineArguments__contains=ex&osArchs=ex&computerName__contains=ex&mitigationStatusesNin=ex&osNames=ex&classificationSources=ex&agentMachineTypes=ex

Export data of threats (as seen in the Console > Incidents) that match the filter. Note: Use the filter. This command exports only 20,000 items (each datum is an item).

Request Params

KeyDatatypeRequiredDescription
k8sNodeName__containsstringFree-text filter by the endpoint Kubernetes node name (supports multiple values)
filePath__containsstringFree-text filter by file path (supports multiple values). Example: "\MyUser\Downloads".
analystVerdictsNinstringExclude threats with specific analyst verdicts. Example: "true_positive,suspicious".
confidenceLevelsNinstringExclude threats with specific confidence level. Example: "malicious".
agentIdsstringList of Agent IDs. Example: "225494730938493804,225494730938493915".
createdAt__gtestringCreated at greater or equal than. Example: "2018-02-27T04:49:26.257525Z".
incidentStatusesNinstringExclude threats with specific incident statuses. Example: "unresolved,in_progress".
initiatedByUsername__containsstringFree-text filter by the username that initiated that threat (supports multiple values). Example: "John,John Doe".
classificationsNinstringList of threat classifications not to search
k8sPodName__containsstringFree-text filter by the endpoint Kubernetes pod name (supports multiple values)
k8sNamespaceLabels__containsstringFree-text filter by the endpoint Kubernetes namespace labels (supports multiple values)
agentIsActivestringInclude Agents currently connected to the Management Console
updatedAt__gtestringUpdated at greater or equal than. Example: "2018-02-27T04:49:26.257525Z".
detectionEnginesNinstringExcluded engines. Example: "reputation".
k8sNamespaceName__containsstringFree-text filter by the endpoint Kubernetes namespace name (supports multiple values)
osTypesNinstringExcluded OS types. Example: "macos".
noteExistsstringThe threat contains at least one note
tenantstringIndicates a Global (tenant) scope request
resolvedstringThis is used for backward-compatibility with API 2.0.
rebootRequiredstringA reboot is required on any endpoint for at least one action on the threat
detectionAgentDomain__containsstringFree-text filter by Agent domain at detection time (supports multiple values). Example: "sentinel,sentinelone.com".
enginesstringIncluded engines. Example: "reputation".
externalTicketExistsstringThe threat contains ticket number
updatedAt__gtstringUpdated at greater than. Example: "2018-02-27T04:49:26.257525Z".
agentVersionsstringInclude Agent versions. Example: "2.5.1.1320".
contentHash__containsstringFree-text filter by file content hash (supports multiple values). Example: "5f09bcff3".
k8sControllerName__containsstringFree-text filter by the endpoint Kubernetes controller name (supports multiple values)
collectionIdsstringList of collection IDs to search. Example: "225494730938493804,225494730938493915".
updatedAt__ltestringUpdated at lesser or equal than. Example: "2018-02-27T04:49:26.257525Z".
k8sPodLabels__containsstringFree-text filter by the endpoint Kubernetes pod labels (supports multiple values)
siteIdsstringList of Site IDs to filter by. Example: "225494730938493804,225494730938493915".
groupIdsstringList of Group IDs to filter by. Example: "225494730938493804,225494730938493915".
threatDetails__containsstringFree-text filter by threat details(supports multiple values). Example: "malware.exe,virus.exe".
detectionAgentVersion__containsstringFree-text filter by Agent version at detection time (supports multiple values). Example: "1.1.1.1,2.2.".
accountIdsstringList of Account IDs to filter by. Example: "225494730938493804,225494730938493915".
mitigationStatusesstringFilter threats by a specific status. Example: "not_mitigated".
containerImageName__containsstringFree-text filter by the endpoint container image name (supports multiple values)
agentMachineTypesNinstringExcluded Agent machine types. Example: "unknown".
contentHashesstringList of sha1 hashes to search for. Example: "d,d,d,5,0,3,0,a,3,d,0,2,9,f,3,8,4,5,f,c,1,0,5,2,4,1,9,8,2,9,f,0,8,f,3,1,2,2,4,0".
originatedProcess__containsstringFree-text filter by the originated process name of the threat (supports multiple values)
publisherName__containsstringFree-text filter by threat's publisher name (supports multiple values). Example: "GOOGLE,Apple Inc.".
containerLabels__containsstringFree-text filter by the endpoint container labels (supports multiple values)
createdAt__ltestringCreated at lesser or equal than. Example: "2018-02-27T04:49:26.257525Z".
classificationsstringList of threat classifications to search
confidenceLevelsstringFilter threats by a specific confidence level. Example: "malicious".
idsstringList of threat IDs. Example: "225494730938493804,225494730938493915".
initiatedBystringOnly include threats from specific initiating sources. Example: "agent_policy,dv_command".
externalTicketId__containsstringFree-text filter by the threat external ticket ID (supports multiple values)
agentVersionsNinstringExcluded Agent versions. Example: "2.5.1.1320".
externalTicketIdsstringExternal ticket ID for the threat
osTypesstringIncluded OS types. Example: "macos".
displayNamestringDisplay name
storylinesstringList of Agent context to search for
storyline__containsstringFree-text filter by threat storyline (supports multiple values). Example: "0000C2E97648,0006FC73-77B4-470F-AAC7-".
querystringFull text search for fields: threat_details, content_hash, computer_name, file_path, uuid, detection_agent_version, realtime_agent_version, detection_agent_domain, command_line_arguments, initiated_by_username, storyline, originated_process, k8s_cluster_name, k8s_node_name, k8s_namespace_name, k8s_namespace_labels, k8s_controller_name, k8s_controller_labels, k8s_pod_name, k8s_pod_labels, container_name, container_image_name, container_labels, external_ticket_id
pendingActionsstringAt least one action is pending for the Agent for the threat
k8sClusterName__containsstringFree-text filter by the endpoint Kubernetes cluster name (supports multiple values)
initiatedByNinstringExclude threats with specific initiating sources. Example: "agent_policy,dv_command".
detectionEnginesstringIncluded engines. Example: "reputation".
enginesNinstringExcluded engines. Example: "reputation".
osNamesNinstringGenerated by shuffler.io OpenAPI
incidentStatusesstringFilter threats by a specific incident status. Example: "unresolved,in_progress".
createdAt__gtstringCreated at greater than. Example: "2018-02-27T04:49:26.257525Z".
updatedAt__ltstringUpdated at lesser than. Example: "2018-02-27T04:49:26.257525Z".
createdAt__ltstringCreated at lesser than. Example: "2018-02-27T04:49:26.257525Z".
mitigatedPreemptivelystringIf the threat was detected pre-execution or post-execution
failedActionsstringAt least one action failed on the threat
realtimeAgentVersion__containsstringFree-text filter by Agent version at current time (supports multiple values). Example: "1.1.1.1,2.2.".
k8sControllerLabels__containsstringFree-text filter by the endpoint Kubernetes controller labels (supports multiple values)
uuid__containsstringFree-text filter by Agent UUID (supports multiple values). Example: "e92-01928,b055".
analystVerdictsstringFilter threats by a specific analyst verdict. Example: "true_positive,suspicious".
countsForstringcomma-separated list of fields to be shown. Example: "osTypes,machineTypes".
containerName__containsstringFree-text filter by the endpoint container name (supports multiple values)
classificationSourcesNinstringClassification sources list to exclude. Example: "Cloud".
commandLineArguments__containsstringFree-text filter by threat command line arguments (supports multiple values). Example: "/usr/sbin/,wget".
osArchsstringIncluded OS Architectures. Example: "32 bit".
computerName__containsstringFree-text filter by computer name (supports multiple values). Example: "john-office,WIN".
mitigationStatusesNinstringFilter threats not by a specific status. Example: "not_mitigated".
osNamesstringGenerated by shuffler.io OpenAPI
classificationSourcesstringClassification sources list. Example: "Cloud".
agentMachineTypesstringInclude Agent machine types. Example: "unknown".

HEADERS

KeyDatatypeRequiredDescription
Content-Typenull