ビュー:

Retrieves a collection of investigation tasks.

HTTP Request

PUT /WebApp/OSCE_iES/OsceIes/ApiEntry

Parameters

Important:

The HTTP request body must contain all required parameters.

Name

Type

Description

Required Parameters

Url

String

Specifies the Endpoint Sensor API request to query

TaskType

Integer

Type of API request

For Endpoint Sensor, the value is always 4.

For available values, see Threat Investigation API Task Types.

Payload

Object

Payload of the request

scanType

Integer array

The method used for the investigation

  • 1: Windows registry

  • 2: YARA rule file

  • 3: IOC rule file

  • 6: Disk IOC rule file

Payload.pagination.offset

Integer

Page where to start retrieving records

Payload.pagination.limit

Integer

Number of records to retrieve

Optional Parameters

scanScheduleId

String

Specify the scanScheduleId of the investigation to retrieve

filter

Object

Filters used to retrieve scans

filter[i].type

Integer

Filter type

  • 10: Task name (partial string match)

  • 11: Creator name (partial string match)

  • 12: Scan method type

    See values for filter[i].value.

  • 14: Criteria name (partial string match)

filter[i].value

Integer

Scan method type

  • 1: Search Windows registry

  • 2: Memory scan using YARA

  • 6: Disk scan uing OpenIOC

HTTP Request Example

PUT /WebApp/OSCE_iES/OsceIes/ApiEntry

HTTP Request Body

Specify a JSON object containing the following HTTP request body:

Request body:

Example 1: Retrieve one-time investigation tasks.

{
    "Url": "V1/Task/ShowScanSummaryList",
    "TaskType": 4,
    "Payload": {
        "pagination": {
            "offset": 0,
            "limit": 50
        },
        "scanType": [1, 2, 6],
	"filter": [{ "type": 10, "value": "Task Name" }]
    }
}

Example 2: Retrieve scheduled investigation history.

{
    "Url": "V1/Task/ShowScanSummaryList",
    "TaskType": 4,
    "Payload": {
        "pagination": {
            "offset": 0,
            "limit": 50
        },
        "scanType": [1, 2, 6],
        "scanScheduleId": "1"
    }
}

Response

If successful, this method returns an HTTP status code of "200", result code of "0", and a response body with the following structure:

{
  "Data": {
    "Code": 0,
    "CodeType": 1,
    "Message": "OK",
    "Data": {
      "taskId": "",
      "lastContentId": "",
      "hasMore": false,
      "serverGuid": "",
      "serverName": "",
      "content": [
        {
          "statusCode": 0,
          "message": "Success",
          "content": {
            "scanSummaryEntity": [
              {
                "scanSummaryId": 1,
                "scanSummaryGuid": 
                "53275df4-51b1-45b7-ad81-4f0b929230f3",
                "status": 3,
                "statusForUI": 3,
                "scanType": 6,
                "submitTime": 1538620467,
                "finishTime": 1538620549,
                "specificAgentType": 1,
                "progressInfo": {
                  "safeCount": 1,
                  "riskCount": 0,
                  "pendingCount": 0,
                  "timeoutCount": 0,
                  "noneCount": 0,
                  "processingCount": 0,
                  "errorCount": 0,
                  "abortCount": 0,
                  "connectionFailCount": 0
                },
                "name": "tttt",
                "agentCount": 1,
                "matchedAgentCount": 0,
                "serverGuidList": [
                  "654B1B52-C3C9-4405-B133-48E2353DA13B"
                ],
                "creator": "jerry",
                "scanCriteriaEntity": {
                  "criteriaId": 1,
                  "criteriaName": "DD IOC.ioc",
                  "criteriaContent": ""
                },
                "errorServers": "[]"
              }
            ],
            "pagination": {
              "offset": 0,
              "limit": 50,
              "total": 1
            }
          }
        }
      ]
    },
    "TimeZone": 8
  },
  "Meta": {
    "result": 1,
    "errorCode": 0,
    "errorMessgae": "Success"
  },
  "PermissionCtrl": {
    "permission": "255",
    "elements": null
  },
  "FeatureCtrl": {
    "mode": "0"
  },
  "SystemCtrl": {
    "TmcmSoDist_Role": "none"
  }
}  

The following table describes the response objects specific to this API.

Name

Type

Description

scanSummaryEntity

Object array

Container for ScanSummaryEntity objects

scanSummaryEntity[i].scanSummaryId

Integer

ID of the investigation

scanSummaryEntity[i].scanSummaryGuid

String

GUID of the investigation

scanSummaryEntity[i].agentCount

Integer

Number of agents in the investigation

scanSummaryEntity[i].matchedAgentCount

Integer

Number of matched agents in the investigation

scanSummaryEntity[i].finishTime

Integer

Date and time when the investigation was completed

scanSummaryEntity[i].name

String

Name of the investigation

scanSummaryEntity[i].scanType

Integer

Method used for the investigation

  • 1: Windows registry

  • 2: YARA rule file

  • 3: IOC rule file

  • 6: Disk IOC rule file

scanSummaryEntity[i].specificAgentType

Integer

Indicates how targets were selected for the investigation

  • 0: All

  • 1: Specific

scanSummaryEntity[i].status

Integer

Status of the investigation

  • 0: Pending

  • 1: Running

  • 2: Cancel

  • 3: Complete

  • 4: Invalid

  • 5: Purged

scanSummaryEntity[i].statusForUI

Integer

Status of the investigation shown in the web console

  • 0: Pending

  • 1: Running

  • 2: Cancel

  • 3: Complete

  • 4: Invalid

  • 5: Purged

  • 6: Error

scanSummaryEntity[i].submitTime

Integer

Date and time when the investigation was submitted

scanSummaryEntity[i].creator

String

Name of the user who created the investigation

scanSummaryEntity[i].serverGuidList

String array

List of server GUID

scanSummaryEntity[i].progressInfo

Object

Progress of the investigation

scanSummaryEntity[i].progressInfo.abortCount

Integer

Number of aborted agents

scanSummaryEntity[i].progressInfo.connectionFailCount

Integer

Number of agents that were unable to connect

scanSummaryEntity[i].progressInfo.errorCount

Integer

Number of agents with errors

scanSummaryEntity[i].progressInfo.noneCount

Integer

Number of agents with "None" status

scanSummaryEntity[i].progressInfo.pendingCount

Integer

Number of agents with "Pending" status

scanSummaryEntity[i].progressInfo.processingCount

Integer

Number of agents with "Processing" status

scanSummaryEntity[i].progressInfo.riskCount

Integer

Number of agents with "Matched" status

scanSummaryEntity[i].progressInfo.safeCount

Integer

Number of agents with "No match" status

scanSummaryEntity[i].progressInfo.timeoutCount

Integer

Number of agents with "Timeout" status

scanSummaryEntity[i].scanCriteriaEntity.criteriaId

Integer

Unique identifier used by the server to store the criteria

scanSummaryEntity[i].scanCriteriaEntity.criteriaName

String

Name of the criteria

  • The criteriaName is "registry" if scanType value is 1 (Windows registry).

  • The criteriaName is the file name for other scanType values.

scanSummaryEntity[i].scanCriteriaEntity.criteriaContent

String

Content of the criteria

  • The criteriaContent is the criteria used to perform registry investigation.

  • The criteriaContent is empty for other scanType values.

scanSummaryEntity[i].errorServers

Object array

Error response if server communication is unsuccessful

For more information about standard responses and response codes for this API, see the following topics: