ShowScanListByScanSummaryGuid

Required Parameters

Url

String

Specifies the Endpoint Sensor API request to query

TaskType

Integer

Type of API request

For Endpoint Sensor, the value is always 4.

For available values, see Threat Investigation API Task Types.

Payload

Object

Payload of the request

scanStatus

Integer

Status of investigation to query

• 1: All

• 2: Matched

• 3: No match

• 4: Pending

• 5: Unsuccessful

scanType

Integer array

Method used for the investigation

Only the following values are supported:

• 0: Custom criteria

• 1: Windows registry

• 2: YARA rule file

• 3: IOC rule file

• 6: Disk IOC rule file

scanSummaryGuid

String array

GUID of the scan summary

Payload.pagination.offset

Integer

Page where to start retrieving records

Payload.pagination.limit

Integer

Number of records to retrieve

Optional Parameters

filter

Object array

Filters used to retrieve scans

filter[i].type

Integer

Filter type

Only the following values are supported:

• 1: Endpoint name (partial string match)

• 4: Endpoint IP address (partial string match)

• 5: Endpoint operating system (partial string match)

• 6: Endpoint user name (partial string match)

filter[i].value

String

Filter value

scanEntity

Object array

Container for scanEntity objects

scanEntity[i].rowId

Integer

Unique id assigned to the investigation row

scanEntity[i].agentGuid

String

GUID of the agent

scanEntity[i].scanSummaryGuid

String

GUID of the investigation

scanEntity[i].status

Integer

Status of the investigation

• 0: None

• 1: Pending

• 2: Processing

• 3: Error

• 4: Complete

• 5: Timeout

• 6: Abort

scanEntity[i].name

String

Name of the investigation

scanEntity[i].riskCount

Integer

Number of matched objects in the investigation

scanEntity[i].triggerTime

Integer

Date and time when the investigation was triggered

scanEntity[i].finishTime

Integer

Date and time when the investigation was completed for each agent

scanEntity[i].submitTime

Integer

Date and time when the investigation was submitted

scanEntity[i].exceedLeafModuleCountLimit

Boolean

Indicates that the investigation returned more than 1000 matched objects

scanEntity[i].scanType

Integer

Method used for the investigation

• 1: Windows registry

• 2: YARA rule file

• 3: IOC rule file

• 6: Disk IOC rule file

scanEntity[i].serverGuid

String

GUID of the server

scanEntity[i].serverName

String

Name of the server

scanEntity[i].isOnline

Boolean

Indicates if the server is online

scanEntity[i].isImportant

Boolean

Indicates if the agent is tagged as important

scanEntity[i].ip

String

IP address of agent

scanEntity[i].machineGuid

String

GUID of the endpoint

scanEntity[i].machineName

String

Name of the endpoint

scanEntity[i].machineType

String

Type of agent

• Desktop

• Server

scanEntity[i].userName

String

User name of agent

scanEntity[i].userGuid

String

GUID of the user

scanEntity[i].isolateStatus

Integer

Isolation status of the agent

• 0: N/A

• 1: Normal

• 2: Isolated

• 3: Isolate command sent - pending

• 4: Restore agent from isolation - pending

scanEntity[i].machineOS

String

Operating system of the endpoint

scanEntity[i].taskType

Integer

Type of API request

For Endpoint Sensor, the value is always 4.

For available values, see Threat Investigation API Task Types.

scanEntity[i].creator

String

Name of the user who created the investigation

scanEntity[i].scanCriteriaEntity

Object

Container for scanCriteria objects

scanEntity[i].scanCriteriaEntity.criteriaId

Integer

Unique identifier used by the server to store the criteria

scanEntity[i].scanCriteriaEntity.criteriaName

String

Name of the criteria

• The criteriaName is "registry" if scanType value is 1 (Windows registry).

• The criteriaName is the file name for other scanType values.

scanEntity[i].scanCriteriaEntity.criteriaContent

String

Content of the criteria

• The criteriaContent is the criteria used to perform registry investigation.

• The criteriaContent is empty for other scanType values.