CreateScanSchedule

Required Parameters

Url

String

Specifies the Endpoint Sensor API request to query

TaskType

Integer

Type of API request

For Endpoint Sensor, the value is always 4.

For available values, see Threat Investigation API Task Types.

Payload

Object

Payload of the request

name

String

Name of the scheduled investigation

scanType

Integer

Method used for the investigation

• 1: Windows registry

• 2: YARA rule file

• 3: IOC rule file

• 6: Disk IOC rule file

timeRange.rangeType

String

Period to be investigated

• ANY: perform investigation on all logged dates

• SPECIFIC: perform investigation only on logs that fall within the specified dates

  For investigations using the SPECIFIC type, values for timeRange.endUnixTime and timeRange.startUnixTime are required.

agentGuid

Object

GUID of the agent

The value of agentGuid is a object of key-value pairs. The key is the serverGuid, and the value is a list of agentGuid strings of the endpoints managed by the target server. It uses the following format:

{ serverGuid : [ agentGuid ] }

If both agentGuid and serverGuid contain an empty array, the request targets all agents.

serverGuid

String array

GUID of servers which manage the endpoints specified in agentGuid

If both agentGuid and serverGuid contain an empty array, the request targets all agents.

userTimezone

String

Local timezone of user, in UTC format

scheduleCriteria.startDate

String

Start date of the scheduled investigation

Specify the value in ISO date format: YYYY-MM-DD

scheduleCriteria.endDate

String

End date of the scheduled investigation

Specify the value in ISO date format: YYYY-MM-DD

scheduleCriteria.repeatType

Integer

Indicates how often the schedule should repeat

• 1: Yearly

• 2: Monthly

• 3: Daily

scheduleCriteria.repeatValue

String

Exact time when the schedule runs, specified in the following format:

• Yearly: "Month:Date:Hour:Minute:Second",

  For example: "05:13:08:00:00"

• Monthly: "Date:Hour:Minute:Second",

  For example: "13:08:00:00"

• Daily: "Hour:Minute:Second",

  For example: "08:00:00"

fileContentCriteria.criteriaHashId

String

Criteria encoded in SHA1 hash format

Use the IoC bucket hash ID if created by the Apex Central IoC bucket (for IoC and YARA).

fileContentCriteria.base64EncodedContent

String

Criteria encoded in base64 format

fileContentCriteria.fileName

String

File name of the OpenIOC and YARA file

Specify an empty value for other criteria types.

selectAll

Object array

Specify a blank value to return all results

To include only results that match certain filters, specify values for selectAll[i].type and selectAll[i].value

For more information, see Threat Investigation API "selectAll" Types and Values.

Optional Parameters

selectAll[i].type

Integer

Return only the results that match the specified filter

For more information, see Threat Investigation API Filter Values.

selectAll[i].value

Integer

Value of the filter type

For more information, see Threat Investigation API "selectAll" Types and Values.

scanScheduleId

Integer

scanScheduleGuid

String

GUID of the scheduled investigation

name

String

Name of the scheduled investigation

userTimezone

String

Local timezone of user, in UTC format

status

Integer

Status of the scheduled investigation

• 0: Disable

• 1: Enable

repeatType

Integer

Indicates how often the schedule should repeat

• 1: Yearly

• 2: Monthly

• 3: Daily

repeatValue

String

Exact time when the schedule runs, specified in the following format:

• Yearly: "Month:Date:Hour:Minute:Second",

  For example: "05:13:08:00:00"

• Monthly: "Date:Hour:Minute:Second",

  For example: "13:08:00:00"

• Daily: "Hour:Minute:Second",

  For example: "08:00:00"

endpointType

Integer

Type of selection for target endpoints

• 0: All

• 1: Specific

Value is always 0 if agentGuid is empty.

startDate

Integer

Start date of the scheduled investigation

endDate

Integer

End date of the scheduled investigation

scanType

Integer

Method used by the investigation

• 1: Windows registry

• 2: YARA rule file

• 3: IOC rule file

• 6: Disk IOC rule file