Authorizations
Bearer authentication header of the form Bearer <token>
, where <token>
is your auth token.
Body
application/json
Available options:
asc
, desc
Filter cases by status
Filter cases by verdict
Available options:
MALICIOUS
, SUSPICIOUS
, BENIGN
Filter cases involving a specific asset
Filter cases by severity
Available options:
INFORMATIONAL
, LOW
, MEDIUM
, HIGH
, CRITICAL
Filter cases by asset type
Available options:
USER
, PROCESS
, USER_AGENT
, FILE
, ENDPOINT
, LOCATION
, IP
, DOMAIN
Filter cases by exclusion rule
Only include cases that were escalated
Only include cases that were contained
Only include cases that involve mobile devices
Only include cases that involved chat ops
Available options:
ENDPOINT
, IDENTITY
, CLOUD
, EMAIL
, NETWORK
, DATA
, POSTURE
, OTHER
Available options:
OTHER__DIAGNOSTIC
, OTHER__INFORMATIONAL_EVENT
, OTHER__WARNING
, OTHER__UNKNOWN
, OTHER__DECEPTION
, OTHER__CUSTOM_DETECTION
, CLOUD__INVOCATION
, CLOUD__DISCOVERY
, CLOUD__DATA_TRANSFER
, CLOUD__PERSISTENCE
, ENDPOINT__DISCOVERY
, ENDPOINT__EXECUTION
, ENDPOINT__LIVE_OFF_THE_LAND
, ENDPOINT__NUISANCE
, ENDPOINT__MALWARE_DISCOVERY
, ENDPOINT__MALWARE_EXECUTION
, ENDPOINT__LATE_STAGE
, ENDPOINT__PERSISTENCE
, ENDPOINT__REMOTE_MANAGEMENT
, ENDPOINT__LATERAL_MOVEMENT
, ENDPOINT__IMPACT
, ENDPOINT__EVASION
, IDENTITY__LOGIN
, IDENTITY__REJECTED_MFA
, IDENTITY__DISCOVERY
, IDENTITY__BRUTE_FORCE
, IDENTITY__PUBLIC_CREDENTIAL_EXPOSURE
, IDENTITY__PRIVATE_CREDENTIAL_EXPOSURE
, IDENTITY__PERSISTENCE
, IDENTITY__ACCOUNT_COMPROMISE
, NETWORK__INBOUND_CONNECTION
, NETWORK__OUTBOUND_CONNECTION
, NETWORK__PHISHING
, NETWORK__NOISY
, EMAIL__PHISHING
, EMAIL__PHISHING_REPORTED
, EMAIL__MALWARE
, EMAIL__MALICIOUS_LINK
, EMAIL__GRAYMAIL
, EMAIL__SPAM
, EMAIL__BUSINESS_EMAIL_COMPROMISE
, DATA__DATA_TRANSFER
, DATA__DATA_SHARE
, POSTURE__POSTURE
Filter by creation date