Get all detections for a case
curl --request GET \
--url https://api.wirespeed.co/v1/cases/{id}/detections \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.wirespeed.co/v1/cases/{id}/detections"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.wirespeed.co/v1/cases/{id}/detections', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/cases/{id}/detections",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/cases/{id}/detections"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.wirespeed.co/v1/cases/{id}/detections")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/cases/{id}/detections")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"teamId": "<string>",
"status": "PREFLIGHT",
"createdAt": "<string>",
"containments": [
"USER"
],
"testMode": true,
"sourceIngestedAt": "<string>",
"sourceDetectedAt": "<string>",
"logs": [
{
"log": "<string>",
"timestamp": "<string>",
"debug": true
}
],
"raw": {},
"verdict": "MALICIOUS",
"title": "<string>",
"integrationPlatform": "acronis",
"contained": true,
"reingested": true,
"prevented": true,
"managedByThirdParty": true,
"excludeFromMeans": true,
"sid": "<string>",
"firstRun": true,
"containOnChatOpsFailure": true,
"wasEscalated": true,
"alwaysNotifyApplied": true,
"category": "OTHER__DIAGNOSTIC",
"chatOpsTest": true,
"severity": "INFORMATIONAL",
"severityOrdinal": 123,
"containsVIP": true,
"containsHVA": true,
"excluded": true,
"endpoints": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"hva": true,
"createdAt": "<string>",
"integrationId": "<string>",
"contained": true,
"workstation": true,
"server": true,
"mobile": true,
"domainController": true,
"groups": [
{
"id": "<string>",
"endpointId": "<string>",
"group": "<string>",
"teamId": "<string>",
"enabled": true,
"createdAt": "<string>",
"overriddenByUser": true,
"groupId": "<string>",
"overriddenByUserId": "<string>",
"overriddenByUserIdentifier": "<string>",
"groupName": "<string>",
"groupSlug": "<string>",
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupAlwaysNotify": true,
"groupIcon": "bot",
"groupRuleSearch": "<string>",
"groupRuleSearchField": "<string>",
"groupRuleSearchType": "text"
}
],
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupsSynced": true,
"sourceDispositions": [
"BLOCKED"
],
"edrSourceId": "<string>",
"mdmSourceId": "<string>",
"name": "<string>",
"hvaOverriddenByUser": true,
"privateIpAddress": "<string>",
"live": true,
"operatingSystem": "<string>",
"operatingSystemCategory": "Windows",
"canonicalId": "<string>",
"canonicalClusterMemberCount": 123,
"canonicalClusterMembers": [
{
"id": "22222222-2222-2222-2222-222222222201",
"displayLabel": "WS-SAMPLE-BRAVO-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002",
"integrationPlatform": "sentinel-one",
"name": "WS-SAMPLE-BRAVO-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows11 - 23H2",
"createdAt": "2025-01-02T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
},
{
"id": "22222222-2222-2222-2222-222222222202",
"displayLabel": "WS-SAMPLE-CHARLIE-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003",
"integrationPlatform": "crowdstrike-falcon",
"name": "WS-SAMPLE-CHARLIE-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows 10 Enterprise 22H2 (OS build 19045.4046)",
"createdAt": "2025-01-03T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
}
],
"managed": true,
"publicIpAddress": "<string>",
"lastSeenAt": "<string>",
"updatedAt": "<string>",
"raw": {},
"lockPin": "<string>"
}
],
"files": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"fileRisk": "BENIGN",
"enrichedViaIntegration": true,
"name": "<string>",
"path": "<string>",
"sha256": "<string>",
"sha1": "<string>",
"toolName": "<string>",
"lastEnrichedAt": "<string>",
"nameWithPath": "<string>",
"metadata": {
"threatNames": [
{
"name": "<string>",
"engine": "<string>",
"excluded": true,
"matchedFileRiskRules": [
"<string>"
]
}
],
"versionInfo": [
{
"name": "<string>",
"value": "<string>"
}
],
"proposedFileNames": [
"<string>"
],
"fileNameCatalogMatches": [
"<string>"
],
"lastScanTime": "<string>",
"story": "<string>"
},
"contained": true,
"sourceDispositions": [
"BLOCKED"
]
}
],
"processes": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"command": "<string>",
"sha256": "<string>",
"sha1": "<string>"
}
],
"locations": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"lat": "<string>",
"lon": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"countryCode": "<string>",
"continent": "<string>",
"continentCode": "<string>",
"mapLat": "<string>",
"mapLon": "<string>"
}
],
"directory": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"additionalEmails": [
"<string>"
],
"allEmails": [
"<string>"
],
"createdAt": "<string>",
"integrationId": "<string>",
"canonicalClusterEmails": [
"<string>"
],
"credentialsExposed": true,
"numberCredentialExposures": 123,
"containable": true,
"smsInviteAttempts": 123,
"groups": [
{
"id": "<string>",
"directoryUserId": "<string>",
"group": "<string>",
"teamId": "<string>",
"overriddenByUser": true,
"overriddenByUserId": "<string>",
"overriddenByUserIdentifier": "<string>",
"enabled": true,
"createdAt": "<string>",
"groupId": "<string>",
"groupName": "<string>",
"groupSlug": "<string>",
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupAlwaysNotify": true,
"groupIcon": "bot",
"groupRuleSearch": "<string>",
"groupRuleSearchField": "<string>",
"groupRuleSearchType": "text"
}
],
"licenses": [
{
"licenseId": "<string>",
"licenseName": "<string>",
"productId": "<string>",
"integrationPlatform": "acronis"
}
],
"onPremises": true,
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupsSynced": true,
"enabled": true,
"directoryId": "<string>",
"name": "<string>",
"phoneNumber": "<string>",
"previousPhoneNumber": "<string>",
"title": "<string>",
"email": "<string>",
"vip": true,
"nhi": true,
"financial": true,
"technical": true,
"external": true,
"managerDirectoryId": "<string>",
"managerEmail": "<string>",
"domain": "<string>",
"department": "<string>",
"canonicalId": "<string>",
"canonicalClusterMemberCount": 123,
"canonicalClusterMembers": [
{
"id": "22222222-2222-2222-2222-222222222201",
"displayLabel": "WS-SAMPLE-BRAVO-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002",
"integrationPlatform": "sentinel-one",
"name": "WS-SAMPLE-BRAVO-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows11 - 23H2",
"createdAt": "2025-01-02T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
},
{
"id": "22222222-2222-2222-2222-222222222202",
"displayLabel": "WS-SAMPLE-CHARLIE-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003",
"integrationPlatform": "crowdstrike-falcon",
"name": "WS-SAMPLE-CHARLIE-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows 10 Enterprise 22H2 (OS build 19045.4046)",
"createdAt": "2025-01-03T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
}
],
"roles": [
"<string>"
],
"lastCredentialExposure": "<string>",
"lastCheckedForCredentialExposures": "<string>",
"needsChatOpsWelcome": true,
"contained": true,
"username": "<string>",
"smsConsentReceivedAt": "<string>",
"smsInviteLastSentAt": "<string>",
"smsInviteOptOut": true,
"administrator": true,
"updatedAt": "<string>",
"passwordLastChangedAt": "<string>",
"lastSignInAt": "<string>",
"raw": {},
"managed": true,
"chatOpsOnboardingUser": true,
"verifiedPhoneNumber": "<string>",
"emailDirection": "sender",
"sourceDispositions": [
"BLOCKED"
]
}
],
"ips": [
{
"displayName": "<string>",
"id": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"metadataLastFetchedAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"ipv4": "<string>",
"ipv6": "<string>",
"metadata": {
"ofac": true,
"adversarial": true,
"ip": "<string>",
"hostname": "<string>",
"city": "<string>",
"region": "<string>",
"country": "<string>",
"loc": "<string>",
"postal": "<string>",
"timezone": "<string>",
"org": "<string>",
"asn": {
"asn": "<string>",
"name": "<string>",
"domain": "<string>",
"type": "<string>",
"route": "<string>"
},
"company": {
"name": "<string>",
"domain": "<string>",
"type": "<string>"
},
"privacy": {
"vpn": true,
"proxy": true,
"tor": true,
"relay": true,
"hosting": true,
"service": "<string>",
"residentialProxy": true,
"lastSeen": "<string>",
"percentDaysSeen": 123
},
"abuse": {
"address": "<string>",
"country": "<string>",
"email": "<string>",
"name": "<string>",
"network": "<string>",
"phone": "<string>",
"ofac": true,
"adversarial": true
},
"domains": {
"ip": "<string>",
"total": 123,
"domains": [
"<string>"
]
},
"isAnycast": true,
"isMobile": true,
"isSatellite": true
},
"locationId": "<string>"
}
],
"domains": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"name": "<string>",
"createdAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"metadata": {
"registrableDomain": "<string>",
"isSubdomain": true,
"popularity": {
"rank": 123,
"sourceDatasetId": "<string>"
},
"registrableDomainPopularity": {
"rank": 123,
"sourceDatasetId": "<string>"
},
"popularityFetchedAt": "<string>",
"czds": {
"status": "found",
"firstSeen": "<string>",
"fetchedAt": "<string>"
},
"hostingProvider": "<string>",
"ownedByTeam": {
"source": "microsoft_tenant",
"tenant": "<string>"
}
}
}
],
"fileRisk": "BENIGN",
"artifacts": [
{
"type": "MAILBOX_RULE",
"data": {
"externalId": "<string>",
"mailbox": {
"address": "<string>",
"addressRole": "owner",
"externalId": "<string>",
"providerMailboxId": "<string>"
},
"operation": "CREATE",
"actions": [
{
"type": "<string>",
"value": "<string>"
}
],
"conditions": [
{
"field": "<string>",
"value": "<string>",
"operator": "<string>"
}
],
"properties": [
{
"name": "<string>",
"value": "<string>"
}
],
"name": "<string>",
"tenantExternalId": "<string>",
"partial": true
}
}
],
"whatHappened": "<string>",
"chatOpsActions": [
{
"id": "<string>",
"teamId": "<string>",
"directoryUserId": "<string>",
"integrationId": "<string>",
"detectionId": "<string>",
"mfaAttempts": 123,
"createdAt": "<string>",
"isSuccessful": true,
"isTimeout": true,
"isRateLimited": true,
"isOverride": true,
"caseId": "<string>",
"message": "<string>",
"settingsAtTimeOfAction": {},
"respondedAt": "<string>",
"ipAddress": "<string>",
"verdict": "MALICIOUS",
"isMfaSuccess": true,
"isMfaFailure": true,
"isMfaUnavailable": true,
"mfaRespondedAt": "<string>"
}
],
"containmentActions": [
{
"id": "<string>",
"teamId": "<string>",
"type": "directory_user",
"action": "contain",
"createdAt": "<string>",
"detectionId": "<string>",
"caseId": "<string>",
"endpointId": "<string>",
"directoryUserId": "<string>",
"fileId": "<string>",
"userId": "<string>",
"result": "success",
"integrationResponse": {},
"subAction": "<string>",
"integrationId": "<string>",
"integrationPlatform": "<string>"
}
],
"groupNames": [
"<string>"
],
"teamName": "<string>",
"sourceDescription": "<string>",
"notes": "<string>",
"sourceName": "<string>",
"displaySourceName": "<string>",
"displaySourceDescription": "<string>",
"displayTitle": "<string>",
"caseId": "<string>",
"verdictedAt": "<string>",
"updatedAt": "<string>",
"closedAt": "<string>",
"refreshRaw": {},
"lastRefreshAt": "<string>",
"helpfulnessRating": "happy",
"integrationId": "<string>",
"duplicateDetectionId": "<string>",
"nextSteps": "<string>",
"caseSid": "<string>",
"escalatedAt": "<string>",
"sourceUrl": "<string>",
"actionSlug": "<string>",
"exclusionId": "<string>",
"exclusionSid": "<string>",
"autoClosed": true,
"autoContained": true,
"verdictSetting": {
"id": "<string>",
"stage": "TRIAGE",
"default": true,
"managedByWspd": true,
"category": "OTHER__DIAGNOSTIC",
"wspdRule": "<string>",
"retired": true,
"escalate": true,
"chatOps": true,
"close": true,
"disabled": true,
"containUserActions": [
"disable"
],
"containEndpointActions": [
"isolate"
],
"containFileActions": [
"delete"
],
"containEphemeralActions": {
"mailbox_rule": [
"delete"
]
},
"uncontainUserActions": [
"enable"
],
"uncontainEndpointActions": [
"unisolate"
],
"uncontainFileActions": [
"unquarantine"
],
"chatOpsMFA": true,
"monitor": true,
"monitorFallbackPreset": "ESCALATE",
"vipChatOps": true,
"createdAt": "<string>",
"updatedAt": "<string>",
"teamId": "<string>",
"chatOpsTimeoutVerdict": "MALICIOUS",
"chatOpsTimeoutMonitor": true,
"chatOpsTimeoutClose": true,
"chatOpsUnsureVerdict": "MALICIOUS",
"verdict": "MALICIOUS",
"description": "<string>",
"managedByParent": true,
"severity": "INFORMATIONAL",
"useSourceSeverity": true,
"ignoresRemediation": true,
"defaults": null,
"containMailboxRuleActions": [
"delete"
]
},
"chatOpsTestEmail": "<string>",
"chatOpsTestPhoneNumber": "<string>",
"customDetectionId": "<string>",
"externalCustomDetectionId": "<string>",
"autoRemediateStartedAt": "<string>",
"remediatedAt": "<string>",
"userAgents": [
{
"id": "<string>",
"userAgent": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"displayName": "<string>",
"userAgentAlt": "<string>",
"browserName": "<string>",
"browserVersion": "<string>",
"browserMajorVersion": "<string>",
"cpuArchitecture": "<string>",
"deviceModel": "<string>",
"deviceVendor": "<string>",
"engineName": "<string>",
"engineVersion": "<string>",
"osName": "<string>",
"osVersion": "<string>"
}
],
"processTree": {
"nodes": [
{
"id": "<string>",
"parentId": "<string>",
"sourceUid": "<string>",
"cpid": "<string>",
"pid": 123,
"createdTime": 123,
"name": "<string>",
"cmdLine": "<string>",
"path": "<string>",
"sha1": "<string>",
"sha256": "<string>"
}
],
"limitsHit": {
"nodes": true,
"edges": true,
"fields": true
}
},
"customDetection": {
"id": "<string>",
"name": "<string>",
"category": "<string>",
"query": "<string>",
"lastRan": "<string>",
"createdAt": "<string>",
"enabled": true,
"alwaysNotify": true,
"createdBy": "<string>",
"updatedAt": "<string>",
"updatedBy": "<string>",
"description": "<string>",
"legacyQuery": "<string>",
"sourceTable": "<string>",
"deduplication": {
"assetTypes": [
"USER"
],
"windowSeconds": 900
}
},
"externalCustomDetection": {
"id": "<string>",
"teamId": "<string>",
"integrationId": "<string>",
"provider": "<string>",
"sourceRuleId": "<string>",
"name": "<string>",
"severityOrdinal": 123,
"status": "<string>",
"alwaysNotify": true,
"providerEnabled": true,
"lastSyncedAt": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"sourceActionSlug": "<string>",
"description": "<string>",
"severity": "<string>",
"category": "<string>",
"aiSuggestedCategory": "<string>",
"aiReasoning": "<string>",
"classifiedAt": "<string>",
"query": "<string>",
"queryLanguage": "<string>",
"ruleGroup": "<string>",
"ruleType": "<string>",
"providerMetadata": {},
"sampleDetection": {},
"providerCreatedAt": "<string>",
"providerUpdatedAt": "<string>",
"deletedAt": "<string>"
},
"managedDetectionRule": {
"slug": "<string>",
"name": "<string>",
"alwaysNotify": true
},
"groups": "<string>"
}
]Cases
Get all detections for a case
GET
/
v1
/
cases
/
{id}
/
detections
Get all detections for a case
curl --request GET \
--url https://api.wirespeed.co/v1/cases/{id}/detections \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.wirespeed.co/v1/cases/{id}/detections"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.wirespeed.co/v1/cases/{id}/detections', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/cases/{id}/detections",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/cases/{id}/detections"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.wirespeed.co/v1/cases/{id}/detections")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/cases/{id}/detections")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"teamId": "<string>",
"status": "PREFLIGHT",
"createdAt": "<string>",
"containments": [
"USER"
],
"testMode": true,
"sourceIngestedAt": "<string>",
"sourceDetectedAt": "<string>",
"logs": [
{
"log": "<string>",
"timestamp": "<string>",
"debug": true
}
],
"raw": {},
"verdict": "MALICIOUS",
"title": "<string>",
"integrationPlatform": "acronis",
"contained": true,
"reingested": true,
"prevented": true,
"managedByThirdParty": true,
"excludeFromMeans": true,
"sid": "<string>",
"firstRun": true,
"containOnChatOpsFailure": true,
"wasEscalated": true,
"alwaysNotifyApplied": true,
"category": "OTHER__DIAGNOSTIC",
"chatOpsTest": true,
"severity": "INFORMATIONAL",
"severityOrdinal": 123,
"containsVIP": true,
"containsHVA": true,
"excluded": true,
"endpoints": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"hva": true,
"createdAt": "<string>",
"integrationId": "<string>",
"contained": true,
"workstation": true,
"server": true,
"mobile": true,
"domainController": true,
"groups": [
{
"id": "<string>",
"endpointId": "<string>",
"group": "<string>",
"teamId": "<string>",
"enabled": true,
"createdAt": "<string>",
"overriddenByUser": true,
"groupId": "<string>",
"overriddenByUserId": "<string>",
"overriddenByUserIdentifier": "<string>",
"groupName": "<string>",
"groupSlug": "<string>",
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupAlwaysNotify": true,
"groupIcon": "bot",
"groupRuleSearch": "<string>",
"groupRuleSearchField": "<string>",
"groupRuleSearchType": "text"
}
],
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupsSynced": true,
"sourceDispositions": [
"BLOCKED"
],
"edrSourceId": "<string>",
"mdmSourceId": "<string>",
"name": "<string>",
"hvaOverriddenByUser": true,
"privateIpAddress": "<string>",
"live": true,
"operatingSystem": "<string>",
"operatingSystemCategory": "Windows",
"canonicalId": "<string>",
"canonicalClusterMemberCount": 123,
"canonicalClusterMembers": [
{
"id": "22222222-2222-2222-2222-222222222201",
"displayLabel": "WS-SAMPLE-BRAVO-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002",
"integrationPlatform": "sentinel-one",
"name": "WS-SAMPLE-BRAVO-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows11 - 23H2",
"createdAt": "2025-01-02T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
},
{
"id": "22222222-2222-2222-2222-222222222202",
"displayLabel": "WS-SAMPLE-CHARLIE-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003",
"integrationPlatform": "crowdstrike-falcon",
"name": "WS-SAMPLE-CHARLIE-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows 10 Enterprise 22H2 (OS build 19045.4046)",
"createdAt": "2025-01-03T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
}
],
"managed": true,
"publicIpAddress": "<string>",
"lastSeenAt": "<string>",
"updatedAt": "<string>",
"raw": {},
"lockPin": "<string>"
}
],
"files": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"fileRisk": "BENIGN",
"enrichedViaIntegration": true,
"name": "<string>",
"path": "<string>",
"sha256": "<string>",
"sha1": "<string>",
"toolName": "<string>",
"lastEnrichedAt": "<string>",
"nameWithPath": "<string>",
"metadata": {
"threatNames": [
{
"name": "<string>",
"engine": "<string>",
"excluded": true,
"matchedFileRiskRules": [
"<string>"
]
}
],
"versionInfo": [
{
"name": "<string>",
"value": "<string>"
}
],
"proposedFileNames": [
"<string>"
],
"fileNameCatalogMatches": [
"<string>"
],
"lastScanTime": "<string>",
"story": "<string>"
},
"contained": true,
"sourceDispositions": [
"BLOCKED"
]
}
],
"processes": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"command": "<string>",
"sha256": "<string>",
"sha1": "<string>"
}
],
"locations": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"lat": "<string>",
"lon": "<string>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"countryCode": "<string>",
"continent": "<string>",
"continentCode": "<string>",
"mapLat": "<string>",
"mapLon": "<string>"
}
],
"directory": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"additionalEmails": [
"<string>"
],
"allEmails": [
"<string>"
],
"createdAt": "<string>",
"integrationId": "<string>",
"canonicalClusterEmails": [
"<string>"
],
"credentialsExposed": true,
"numberCredentialExposures": 123,
"containable": true,
"smsInviteAttempts": 123,
"groups": [
{
"id": "<string>",
"directoryUserId": "<string>",
"group": "<string>",
"teamId": "<string>",
"overriddenByUser": true,
"overriddenByUserId": "<string>",
"overriddenByUserIdentifier": "<string>",
"enabled": true,
"createdAt": "<string>",
"groupId": "<string>",
"groupName": "<string>",
"groupSlug": "<string>",
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupAlwaysNotify": true,
"groupIcon": "bot",
"groupRuleSearch": "<string>",
"groupRuleSearchField": "<string>",
"groupRuleSearchType": "text"
}
],
"licenses": [
{
"licenseId": "<string>",
"licenseName": "<string>",
"productId": "<string>",
"integrationPlatform": "acronis"
}
],
"onPremises": true,
"groupContainmentEnabled": true,
"groupChatOpsEnabled": true,
"groupSourceSystemUpdates": true,
"groupsSynced": true,
"enabled": true,
"directoryId": "<string>",
"name": "<string>",
"phoneNumber": "<string>",
"previousPhoneNumber": "<string>",
"title": "<string>",
"email": "<string>",
"vip": true,
"nhi": true,
"financial": true,
"technical": true,
"external": true,
"managerDirectoryId": "<string>",
"managerEmail": "<string>",
"domain": "<string>",
"department": "<string>",
"canonicalId": "<string>",
"canonicalClusterMemberCount": 123,
"canonicalClusterMembers": [
{
"id": "22222222-2222-2222-2222-222222222201",
"displayLabel": "WS-SAMPLE-BRAVO-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0002",
"integrationPlatform": "sentinel-one",
"name": "WS-SAMPLE-BRAVO-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows11 - 23H2",
"createdAt": "2025-01-02T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
},
{
"id": "22222222-2222-2222-2222-222222222202",
"displayLabel": "WS-SAMPLE-CHARLIE-WKS$",
"integrationId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeee0003",
"integrationPlatform": "crowdstrike-falcon",
"name": "WS-SAMPLE-CHARLIE-WKS$",
"managed": true,
"live": true,
"operatingSystem": "Windows 10 Enterprise 22H2 (OS build 19045.4046)",
"createdAt": "2025-01-03T00:00:00.000Z",
"updatedAt": "2025-01-15T12:00:00.000Z"
}
],
"roles": [
"<string>"
],
"lastCredentialExposure": "<string>",
"lastCheckedForCredentialExposures": "<string>",
"needsChatOpsWelcome": true,
"contained": true,
"username": "<string>",
"smsConsentReceivedAt": "<string>",
"smsInviteLastSentAt": "<string>",
"smsInviteOptOut": true,
"administrator": true,
"updatedAt": "<string>",
"passwordLastChangedAt": "<string>",
"lastSignInAt": "<string>",
"raw": {},
"managed": true,
"chatOpsOnboardingUser": true,
"verifiedPhoneNumber": "<string>",
"emailDirection": "sender",
"sourceDispositions": [
"BLOCKED"
]
}
],
"ips": [
{
"displayName": "<string>",
"id": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"metadataLastFetchedAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"ipv4": "<string>",
"ipv6": "<string>",
"metadata": {
"ofac": true,
"adversarial": true,
"ip": "<string>",
"hostname": "<string>",
"city": "<string>",
"region": "<string>",
"country": "<string>",
"loc": "<string>",
"postal": "<string>",
"timezone": "<string>",
"org": "<string>",
"asn": {
"asn": "<string>",
"name": "<string>",
"domain": "<string>",
"type": "<string>",
"route": "<string>"
},
"company": {
"name": "<string>",
"domain": "<string>",
"type": "<string>"
},
"privacy": {
"vpn": true,
"proxy": true,
"tor": true,
"relay": true,
"hosting": true,
"service": "<string>",
"residentialProxy": true,
"lastSeen": "<string>",
"percentDaysSeen": 123
},
"abuse": {
"address": "<string>",
"country": "<string>",
"email": "<string>",
"name": "<string>",
"network": "<string>",
"phone": "<string>",
"ofac": true,
"adversarial": true
},
"domains": {
"ip": "<string>",
"total": 123,
"domains": [
"<string>"
]
},
"isAnycast": true,
"isMobile": true,
"isSatellite": true
},
"locationId": "<string>"
}
],
"domains": [
{
"id": "<string>",
"displayName": "<string>",
"teamId": "<string>",
"name": "<string>",
"createdAt": "<string>",
"sourceDispositions": [
"BLOCKED"
],
"metadata": {
"registrableDomain": "<string>",
"isSubdomain": true,
"popularity": {
"rank": 123,
"sourceDatasetId": "<string>"
},
"registrableDomainPopularity": {
"rank": 123,
"sourceDatasetId": "<string>"
},
"popularityFetchedAt": "<string>",
"czds": {
"status": "found",
"firstSeen": "<string>",
"fetchedAt": "<string>"
},
"hostingProvider": "<string>",
"ownedByTeam": {
"source": "microsoft_tenant",
"tenant": "<string>"
}
}
}
],
"fileRisk": "BENIGN",
"artifacts": [
{
"type": "MAILBOX_RULE",
"data": {
"externalId": "<string>",
"mailbox": {
"address": "<string>",
"addressRole": "owner",
"externalId": "<string>",
"providerMailboxId": "<string>"
},
"operation": "CREATE",
"actions": [
{
"type": "<string>",
"value": "<string>"
}
],
"conditions": [
{
"field": "<string>",
"value": "<string>",
"operator": "<string>"
}
],
"properties": [
{
"name": "<string>",
"value": "<string>"
}
],
"name": "<string>",
"tenantExternalId": "<string>",
"partial": true
}
}
],
"whatHappened": "<string>",
"chatOpsActions": [
{
"id": "<string>",
"teamId": "<string>",
"directoryUserId": "<string>",
"integrationId": "<string>",
"detectionId": "<string>",
"mfaAttempts": 123,
"createdAt": "<string>",
"isSuccessful": true,
"isTimeout": true,
"isRateLimited": true,
"isOverride": true,
"caseId": "<string>",
"message": "<string>",
"settingsAtTimeOfAction": {},
"respondedAt": "<string>",
"ipAddress": "<string>",
"verdict": "MALICIOUS",
"isMfaSuccess": true,
"isMfaFailure": true,
"isMfaUnavailable": true,
"mfaRespondedAt": "<string>"
}
],
"containmentActions": [
{
"id": "<string>",
"teamId": "<string>",
"type": "directory_user",
"action": "contain",
"createdAt": "<string>",
"detectionId": "<string>",
"caseId": "<string>",
"endpointId": "<string>",
"directoryUserId": "<string>",
"fileId": "<string>",
"userId": "<string>",
"result": "success",
"integrationResponse": {},
"subAction": "<string>",
"integrationId": "<string>",
"integrationPlatform": "<string>"
}
],
"groupNames": [
"<string>"
],
"teamName": "<string>",
"sourceDescription": "<string>",
"notes": "<string>",
"sourceName": "<string>",
"displaySourceName": "<string>",
"displaySourceDescription": "<string>",
"displayTitle": "<string>",
"caseId": "<string>",
"verdictedAt": "<string>",
"updatedAt": "<string>",
"closedAt": "<string>",
"refreshRaw": {},
"lastRefreshAt": "<string>",
"helpfulnessRating": "happy",
"integrationId": "<string>",
"duplicateDetectionId": "<string>",
"nextSteps": "<string>",
"caseSid": "<string>",
"escalatedAt": "<string>",
"sourceUrl": "<string>",
"actionSlug": "<string>",
"exclusionId": "<string>",
"exclusionSid": "<string>",
"autoClosed": true,
"autoContained": true,
"verdictSetting": {
"id": "<string>",
"stage": "TRIAGE",
"default": true,
"managedByWspd": true,
"category": "OTHER__DIAGNOSTIC",
"wspdRule": "<string>",
"retired": true,
"escalate": true,
"chatOps": true,
"close": true,
"disabled": true,
"containUserActions": [
"disable"
],
"containEndpointActions": [
"isolate"
],
"containFileActions": [
"delete"
],
"containEphemeralActions": {
"mailbox_rule": [
"delete"
]
},
"uncontainUserActions": [
"enable"
],
"uncontainEndpointActions": [
"unisolate"
],
"uncontainFileActions": [
"unquarantine"
],
"chatOpsMFA": true,
"monitor": true,
"monitorFallbackPreset": "ESCALATE",
"vipChatOps": true,
"createdAt": "<string>",
"updatedAt": "<string>",
"teamId": "<string>",
"chatOpsTimeoutVerdict": "MALICIOUS",
"chatOpsTimeoutMonitor": true,
"chatOpsTimeoutClose": true,
"chatOpsUnsureVerdict": "MALICIOUS",
"verdict": "MALICIOUS",
"description": "<string>",
"managedByParent": true,
"severity": "INFORMATIONAL",
"useSourceSeverity": true,
"ignoresRemediation": true,
"defaults": null,
"containMailboxRuleActions": [
"delete"
]
},
"chatOpsTestEmail": "<string>",
"chatOpsTestPhoneNumber": "<string>",
"customDetectionId": "<string>",
"externalCustomDetectionId": "<string>",
"autoRemediateStartedAt": "<string>",
"remediatedAt": "<string>",
"userAgents": [
{
"id": "<string>",
"userAgent": "<string>",
"teamId": "<string>",
"createdAt": "<string>",
"displayName": "<string>",
"userAgentAlt": "<string>",
"browserName": "<string>",
"browserVersion": "<string>",
"browserMajorVersion": "<string>",
"cpuArchitecture": "<string>",
"deviceModel": "<string>",
"deviceVendor": "<string>",
"engineName": "<string>",
"engineVersion": "<string>",
"osName": "<string>",
"osVersion": "<string>"
}
],
"processTree": {
"nodes": [
{
"id": "<string>",
"parentId": "<string>",
"sourceUid": "<string>",
"cpid": "<string>",
"pid": 123,
"createdTime": 123,
"name": "<string>",
"cmdLine": "<string>",
"path": "<string>",
"sha1": "<string>",
"sha256": "<string>"
}
],
"limitsHit": {
"nodes": true,
"edges": true,
"fields": true
}
},
"customDetection": {
"id": "<string>",
"name": "<string>",
"category": "<string>",
"query": "<string>",
"lastRan": "<string>",
"createdAt": "<string>",
"enabled": true,
"alwaysNotify": true,
"createdBy": "<string>",
"updatedAt": "<string>",
"updatedBy": "<string>",
"description": "<string>",
"legacyQuery": "<string>",
"sourceTable": "<string>",
"deduplication": {
"assetTypes": [
"USER"
],
"windowSeconds": 900
}
},
"externalCustomDetection": {
"id": "<string>",
"teamId": "<string>",
"integrationId": "<string>",
"provider": "<string>",
"sourceRuleId": "<string>",
"name": "<string>",
"severityOrdinal": 123,
"status": "<string>",
"alwaysNotify": true,
"providerEnabled": true,
"lastSyncedAt": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"sourceActionSlug": "<string>",
"description": "<string>",
"severity": "<string>",
"category": "<string>",
"aiSuggestedCategory": "<string>",
"aiReasoning": "<string>",
"classifiedAt": "<string>",
"query": "<string>",
"queryLanguage": "<string>",
"ruleGroup": "<string>",
"ruleType": "<string>",
"providerMetadata": {},
"sampleDetection": {},
"providerCreatedAt": "<string>",
"providerUpdatedAt": "<string>",
"deletedAt": "<string>"
},
"managedDetectionRule": {
"slug": "<string>",
"name": "<string>",
"alwaysNotify": true
},
"groups": "<string>"
}
]Authorizations
Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.
Path Parameters
Case identifier
Response
200 - application/json
Unique identifier for the detection
ID of the team that owns this detection
Current status of the detection
Available options:
PREFLIGHT, NEW, PROCESSING, ESCALATED, HUNTING, MONITORING, CHATOPS, CLOSED Timestamp when the detection was created
Types of containment actions performed
Available options:
USER, PROCESS, USER_AGENT, FILE, ENDPOINT, LOCATION, IP, DOMAIN Deprecated. Always false: test mode is replaced by the team master switches (chatOpsEnabled, remediationEnabled, sourceSystemUpdatesEnabled). Retained so existing public API clients keep receiving this required field. Removal scheduled for 2027-01-06.
Timestamp when the detection was ingested by Wirespeed
Timestamp when the detection was originally detected by source
Chronological log entries for this detection
Show child attributes
Show child attributes
Raw detection data from the source system
Final verdict assigned to the detection
Available options:
MALICIOUS, SUSPICIOUS, BENIGN Display title for the detection
Source integration platform that generated this detection
Available options:
acronis, action1, admin-by-request, agger-labs, anthropic, aws, axonius, barracuda-cloudgen-firewall, bitwarden, box, checkpoint-firewall, checkpoint-harmony, cisco-asa, cisco-catalyst, cisco-duo, cisco-meraki, cisco-secure-access, cisco-secure-endpoint, cisco-umbrella, cloudflare, connectwise-psa, crowdstrike-falcon, cursor, cyberark, darktrace, darktrace-email-security, datto-edr, dfir-iris, email, exium, fleet-dm, fortianalyzer, fortinet, freshservice, generic-json, generic-syslog, github, github-enterprise-cloud, google-alert-center, google-chronicle, google-cloud-audit-logs, google-directory, google-security-center, halcyon, halo-itsm, have-i-been-pwned, horizon3, hyas-protect, ipinfo, jamf-internet-security, jamf-pro, jamf-protect, jira-cloud, jira-data-center, jumpcloud, kandji, manage-engine-ad-audit-plus, microsoft, microsoft-entra, microsoft-teams, microsoft-teams-v2, mimecast, netskope, ninjaone, odoo-helpdesk, okta, one-password, onelogin, openai, openvpn-access-server, orca-security, pager-duty, palo-alto-networks-cortex, palo-alto-ngfw, perception-point, pfsense, picus, ping-one, proofpoint, reversing-labs, safebreach, sandfly, sentinel-one, service-now, slack, sms, smtp, sonic-wall, sophos, sophos-firewall, splunk, stairwell, sublime-security, tenable-nessus, thinkst-canary, threatlocker, three-cx, tracebit, unifi, upwind, varonis-datadvantage, vectra, vmware-vsphere, watchguard-firebox, windows-event-logs, wirespeed, wiz, wordfence, zabbix, zscaler-zpa Whether containment actions were performed on this detection
Whether this detection was reprocessed after initial ingestion
Whether the detected threat was successfully prevented
Whether this detection is managed by a third-party service (e.g. Falcon Complete)
Whether to exclude this detection from MTTC and other metrics calculations
Short identifier for this detection
Whether this is the first time this detection has been processed
Whether to automatically contain if ChatOps workflow fails
Whether this detection was escalated to external systems
Whether Always Notify policy forced escalation for this detection
Security category classification for this detection
Available options:
OTHER__DIAGNOSTIC, OTHER__INFORMATIONAL_EVENT, OTHER__WARNING, OTHER__EXPERIMENTAL, OTHER__UNKNOWN, OTHER__DECEPTION, OTHER__DECEPTION__SIMULATION, OTHER__CUSTOM_DETECTION, CLOUD__INVOCATION, CLOUD__DISCOVERY, CLOUD__DATA_TRANSFER, CLOUD__PERSISTENCE, CLOUD__PUBLIC_BUCKET, ENDPOINT__DISCOVERY, ENDPOINT__EXECUTION, ENDPOINT__LIVE_OFF_THE_LAND, ENDPOINT__NUISANCE, ENDPOINT__MALWARE_DISCOVERY, ENDPOINT__MALWARE_EXECUTION, ENDPOINT__LATE_STAGE, ENDPOINT__PERSISTENCE, ENDPOINT__REMOTE_MANAGEMENT, ENDPOINT__LATERAL_MOVEMENT, ENDPOINT__IMPACT, ENDPOINT__EVASION, ENDPOINT__EXPLOITATION, ENDPOINT__SIMULATION, ENDPOINT__PLANNED_CHANGE, IDENTITY__LOGIN, IDENTITY__REJECTED_MFA, IDENTITY__DISCOVERY, IDENTITY__BRUTE_FORCE, IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE, IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE, IDENTITY__PERSISTENCE, IDENTITY__ACCOUNT_COMPROMISE, IDENTITY__OAUTH_GRANT, IDENTITY__SIMULATION, IDENTITY__PLANNED_CHANGE, NETWORK__INBOUND_CONNECTION, NETWORK__OUTBOUND_CONNECTION, NETWORK__PHISHING, NETWORK__NOISY, NETWORK__DISCOVERY, EMAIL__PHISHING, EMAIL__PHISHING_REPORTED, EMAIL__EVASION, EMAIL__MALWARE, EMAIL__MALICIOUS_LINK, EMAIL__GRAYMAIL, EMAIL__SPAM, EMAIL__BUSINESS_EMAIL_COMPROMISE, EMAIL__MAILBOX_RULE, EMAIL__CHAT, DATA__DATA_TRANSFER, DATA__DATA_SHARE, POSTURE__POSTURE, POSTURE__HEALTH Whether this detection is part of a ChatOps test scenario
Severity level of the detection
Available options:
INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL Numeric representation of severity for sorting purposes
Whether this detection involves VIP users
Whether this detection involves critical assets
Whether this detection is excluded by an exclusion rule
Endpoints involved in this detection
Show child attributes
Show child attributes
Files involved in this detection
Show child attributes
Show child attributes
Processes involved in this detection
Show child attributes
Show child attributes
Geographic locations involved in this detection
Show child attributes
Show child attributes
Directory users involved in this detection
Show child attributes
Show child attributes
IP addresses involved in this detection
Show child attributes
Show child attributes
Domains involved in this detection
Show child attributes
Show child attributes
Highest risk level among all files in this detection
Available options:
BENIGN, MALWARE, LATE_STAGE, NUISANCE, LIVE_OFF_THE_LAND, REMOTE_MANAGEMENT, UNKNOWN Embedded artifacts extracted from this detection
Show child attributes
Show child attributes
AI-generated summary of what happened in this detection
ChatOps actions performed on this detection
Show child attributes
Show child attributes
Containment actions performed on this detection
Show child attributes
Show child attributes
Unique group names from endpoints and directory users on this detection
Name of the team that owns this detection
Description from the source system
User-added notes about the detection
Name of the source that generated this detection
sourceName rendered for display in the caller's language. Equals sourceName for vendor titles. Filter, match, and exclude on sourceName.
sourceDescription rendered for display in the caller's language. Equals sourceDescription for vendor text.
title rendered for display in the caller's language.
ID of the case this detection belongs to
Timestamp when the detection verdict was assigned
Timestamp when the detection was last updated
Timestamp when the detection was closed
Raw detection data from the most recent refresh
Timestamp of the last successful detection refresh
Helpfulness feedback selected when detection was resolved
Available options:
happy, neutral, unhappy ID of the integration instance that generated this detection
ID of the original detection if this is a duplicate
Legacy prose next steps, kept for backwards compatibility. Use the structured case nextSteps instead. Scheduled for removal after 2027-04-01.
Short identifier for the case this detection belongs to
Timestamp when the detection was escalated
URL for this detection in its source system
Slug identifier for the action taken on this detection
ID of the exclusion rule that matches this detection
Short identifier for the exclusion rule that matches this detection
Whether this detection was automatically contained by the system
Verdict rule configuration that was applied to this detection
Show child attributes
Show child attributes
Email address for ChatOps testing notifications
Phone number for ChatOps testing notifications
ID of the custom detection that detected this detection
ID of the external custom detection rule that matched this detection
Timestamp when auto remediation started
Timestamp when remediation was completed
User agents involved in this detection
Show child attributes
Show child attributes
Normalized process hierarchy extracted from this detection
Show child attributes
Show child attributes
Wirespeed custom detection rule that fired this alert
Show child attributes
Show child attributes
Imported vendor rule that fired this alert
Show child attributes
Show child attributes
Wirespeed managed detection rule that fired this alert
Show child attributes
Show child attributes
CSV of unique group names from endpoints and directory users