Get Security Logs

HTTPS Request

GET https://<serviceURL>/v1/siem/security_events

Request Parameters

Important The request must contain the required parameters.

Parameter	Description
Required Parameter
service	Name of the protected service whose logs you want to retrieve. Important Specify one service at a time. Options include: exchange Note This option covers only Exchange Online related logs. sharepoint onedrive dropbox box googledrive gmail teams exchangeserver Note This option covers Exchange Server related logs from ScanMail for Microsoft Exchange after your ScanMail server is registered to Cloud App Security. salesforce_sandbox salesforce_production teams_chat
event	Type of the security event whose logs you want to retrieve. Options include: securityrisk virtualanalyzer ransomware dlp Important Specify one event type at a time.
Optional Parameter
start end	Start and end time during which logs are to retrieve. Format: ISO 8601 timestamp to the second or millisecond in UTC, yyyy-mm-ddThh:mm:ss[.mmm]Z. For example, 2016-07-22T01:51:31Z or 2016-07-22T01:51:31.001Z. The request retrieves logs within a maximum of 72 hours before the point of time when the request is sent according to the start and end settings: If both start and end are not specified, the request retrieves logs within five minutes before the point of time when the request is sent. If both start and end are specified, the request retrieves logs within the configured duration. Make sure the end time is no earlier than the start time. If only start is specified, the request retrieves logs within five minutes after the point of the configured start time. If only end is specified, the request retrieves logs within five minutes before the point of the configured end time.
limit	Number of log items to display at a time. A maximum of 500 log items are allowed. If not specified, the value is set to 500 by default. If the total log items requested exceed the specified limit, a URL is provided in the next_link field in the response. Use this URL to form a second request to retrieve the remaining log items for the previous request. Repeat this until all log items for the first request are obtained.

Request Example

GET https://api.tmcas.trendmicro.com/v1/siem/security_events?service=exchange&event=dlp
Authorization: Bearer 1de231142eef3f83928da98dc251fbebb6cafe77

• GET https://api.tmcas.trendmicro.com/v1/siem/security_events?service=exchange&event=securityrisk&
  start=2018-09-23T03:35:07.000Z&end=2018-09-25T05:47:07.000Z&limit=10
  Authorization: Bearer 1de231142eef3f83928da98dc251fbebb6cafe77

• If the total log items requested exceed 10, use the URL in the next_link field in the response to form a second request as:

  GET https://api.tmcas.trendmicro.com/v1/siem/security_events?service=exchange&event=securityrisk&
  start=2018-09-23T03:35:07.000Z&end=2018-09-25T05:47:07.000Z&limit=10&page_id=<randomly generated value>=
  Authorization: Bearer 1de231142eef3f83928da98dc251fbebb6cafe77

Response

Response Example

HTTP/1.1 200
Content-Type: application/json

{
    "current_link": "https://api.tmcas.trendmicro.com/v1/siem/security_events?service=exchange&event=securityrisk&
     start=2018-09-23T03:35:07.000Z&end=2018-09-25T05:47:07.000Z&limit=1",
    "next_link": "https://api.tmcas.trendmicro.com/v1/siem/security_events?service=exchange&event=securityrisk&
     start=2018-09-23T03:35:07.000Z&end=2018-09-25T05:47:07.000Z&limit=1&page_id=<randomly generated value>=",
    "last_log_item_generation_time": "2018-09-25T02:14:40Z",
    "security_events": [
        {
            "log_item_id": "NdGBDmYBWu4z8GKN0Jhl",
            "service": "exchange",
            "event": "security_risk_scan",
            "message": {
                "scan_type": "Real-time scan",
                "affected_user": "username1@example1.onmicrosoft.com",
                "location": "username1@example1.onmicrosoft.com\\Junk Email",
                "detection_time": "2018-09-25T02:14:40Z",
                "triggered_policy_name": "phishing test from jimmy",
                "triggered_security_filter": "Web Reputation",
                "action": "Quarantine",
                "action_result": "success",
                "mail_message_id": "<0ee59974fb7c48538b3e077f5c40b877@trendmicro.com>",
                "mail_message_sender": "<username2@example2.com>",
                "mail_message_recipient": [
                    "\"username1\"<username1@example1.onmicrosoft.com>"
                ],
                "mail_message_submit_time": "2018-09-25T02:14:25.818Z",
                "mail_message_delivery_time": "2018-09-25T02:14:24",
                "mail_message_subject": "aaaa",
                "mail_message_file_name": "filename.exe",
                "security_risk_name": "Spyware: http://wrs21.winshipway.com",
                "detected_by": "Web Reputation",
                "risk_level": "Dangerous"
            }
        }
    ]
}

Response Fields

Note All time-related fields in the table are set to Coordinated Universal Time (UTC).