List Investigations
curl --request GET \
--url http://investigations.{region}.alienvault.cloud/investigations/v3/investigations \
--header 'Authorization: Bearer <token>'import requests
url = "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('http://investigations.{region}.alienvault.cloud/investigations/v3/investigations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://investigations.{region}.alienvault.cloud/investigations/v3/investigations")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("http://investigations.{region}.alienvault.cloud/investigations/v3/investigations")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=2&perPage=3"
},
"prev": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=1&perPage=3"
},
"next": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=3&perPage=3"
},
"first": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=1&perPage=3"
},
"last": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=5&perPage=3"
}
},
"page": {
"size": 3,
"totalElements": 13,
"totalPages": 5,
"number": 2
},
"investigations": [
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes"
}
},
"_embedded": {
"attachments": {
"elements": 1
},
"evidence": {
"elements": 6
},
"notes": {
"elements": 3
},
"history": {
"elements": 21
}
},
"id": "2033c597-97d2-49f4-b3b6-c9079d46c0f2",
"i3": "INV-201811-22-0023",
"title": "A weird error",
"description": "I found this strange error in my logs. It could be serious.",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Medium",
"intent": "Reconnaissance & Probing",
"status": "Open",
"assignedTo": "ace@some.mssp.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T15:38:52.132Z"
},
"lastModified": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T15:38:52.132Z"
}
},
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/notes"
}
},
"_embedded": {
"attachments": {
"elements": 0
},
"evidence": {
"elements": 1
},
"notes": {
"elements": 1
},
"history": {
"elements": 5
}
},
"id": "1b51359b-5b0b-4fa5-a045-4e40dfd1df58",
"i3": "INV-201811-22-0021",
"title": "Something to investigate",
"description": "We should probably look into this.",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Low",
"intent": "Environmental Awareness",
"status": "In Review",
"assignedTo": "user@asecurityteam.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-06T10:18:33.765Z"
},
"lastModified": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T09:11:32.445Z"
}
},
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/notes"
}
},
"_embedded": {
"attachments": {
"elements": 0
},
"evidence": {
"elements": 13
},
"notes": {
"elements": 41
},
"history": {
"elements": 127
}
},
"id": "e0e5c3e8-7702-464d-941a-57caea765d2d",
"i3": "INV-201811-22-0019",
"title": "FIX THIS NOW!",
"description": "A critical flaw in our security that needs IMMEDIATE attention!",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Critical",
"intent": "Delivery & Attack",
"status": "Closed",
"assignedTo": "ace@some.mssp.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T14:55:02.132Z"
},
"lastModified": {
"by": "ace@some.mssp.com",
"on": "2018-11-07T14:59:02.132Z"
}
}
],
"_embedded": {}
}{
"errorId": "<string>",
"message": "<string>",
"variables": [
"<string>"
],
"errorUrl": "<string>"
}Investigations
List Investigations
Returns the list of investigations. Pagination and querying available.
GET
/
investigations
List Investigations
curl --request GET \
--url http://investigations.{region}.alienvault.cloud/investigations/v3/investigations \
--header 'Authorization: Bearer <token>'import requests
url = "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('http://investigations.{region}.alienvault.cloud/investigations/v3/investigations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "http://investigations.{region}.alienvault.cloud/investigations/v3/investigations"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("http://investigations.{region}.alienvault.cloud/investigations/v3/investigations")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("http://investigations.{region}.alienvault.cloud/investigations/v3/investigations")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=2&perPage=3"
},
"prev": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=1&perPage=3"
},
"next": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=3&perPage=3"
},
"first": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=1&perPage=3"
},
"last": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations?deployments=cn%3A%2F%2Fasecurityteam.alienvault.cloud&page=5&perPage=3"
}
},
"page": {
"size": 3,
"totalElements": 13,
"totalPages": 5,
"number": 2
},
"investigations": [
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/2033c597-97d2-49f4-b3b6-c9079d46c0f2/notes"
}
},
"_embedded": {
"attachments": {
"elements": 1
},
"evidence": {
"elements": 6
},
"notes": {
"elements": 3
},
"history": {
"elements": 21
}
},
"id": "2033c597-97d2-49f4-b3b6-c9079d46c0f2",
"i3": "INV-201811-22-0023",
"title": "A weird error",
"description": "I found this strange error in my logs. It could be serious.",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Medium",
"intent": "Reconnaissance & Probing",
"status": "Open",
"assignedTo": "ace@some.mssp.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T15:38:52.132Z"
},
"lastModified": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T15:38:52.132Z"
}
},
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/1b51359b-5b0b-4fa5-a045-4e40dfd1df58/notes"
}
},
"_embedded": {
"attachments": {
"elements": 0
},
"evidence": {
"elements": 1
},
"notes": {
"elements": 1
},
"history": {
"elements": 5
}
},
"id": "1b51359b-5b0b-4fa5-a045-4e40dfd1df58",
"i3": "INV-201811-22-0021",
"title": "Something to investigate",
"description": "We should probably look into this.",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Low",
"intent": "Environmental Awareness",
"status": "In Review",
"assignedTo": "user@asecurityteam.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-06T10:18:33.765Z"
},
"lastModified": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T09:11:32.445Z"
}
},
{
"_links": {
"self": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d"
},
"attachments": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/attachments"
},
"evidence": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/evidence"
},
"history": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/history"
},
"notes": {
"href": "https://svc.alienvault.cloud/investigations/v3/investigations/e0e5c3e8-7702-464d-941a-57caea765d2d/notes"
}
},
"_embedded": {
"attachments": {
"elements": 0
},
"evidence": {
"elements": 13
},
"notes": {
"elements": 41
},
"history": {
"elements": 127
}
},
"id": "e0e5c3e8-7702-464d-941a-57caea765d2d",
"i3": "INV-201811-22-0019",
"title": "FIX THIS NOW!",
"description": "A critical flaw in our security that needs IMMEDIATE attention!",
"deployment": "cn://asecurityteam.alienvault.cloud",
"private": false,
"severity": "Critical",
"intent": "Delivery & Attack",
"status": "Closed",
"assignedTo": "ace@some.mssp.com",
"created": {
"by": "user@asecurityteam.com",
"on": "2018-11-07T14:55:02.132Z"
},
"lastModified": {
"by": "ace@some.mssp.com",
"on": "2018-11-07T14:59:02.132Z"
}
}
],
"_embedded": {}
}{
"errorId": "<string>",
"message": "<string>",
"variables": [
"<string>"
],
"errorUrl": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
A client-provided value that uniquely identifies a client generated message sent to the service. This header will be reflected back unchanged in the response.
Query Parameters
In GET operations, a consumer application may want selected attributes of a representation. Although the consumer can ignore attributes it doesn’t utilize, transferring the attributes wastes bandwidth and time. Hence, for performance reasons, the consumer wants only the attributes it uses.
When requesting multiple fields, separate their names with commas.
For example fields=name,breed
When requesting fields from nested data structures use the name
of the nested object and parentheses for the nested object's
fields. For example
fields=name,proficiencies(sheepHerding,obedience)
When requesting an entire nested data structure use the name
of the nested object. For example
fields=name,proficiencies
The number of the page being requested starting with 1
'An integer that describes the number of objects contained in a page. The maximum page size is {TBD}. If a number greater than this is specified, the server will use the maximum page size instead.'
RSQL query string
⌘I