Important
Ce point d'accès à l'API REST v1 de Netskope sera supprimé le 15/10/2024. Pour plus de détails, reportez-vous au document End of Life (EOL) for Specific REST API v1 Endpoints (Fin de vie des points d'extrémité de l'API REST v1 ).
Ce point d'accès renvoie les alertes générées par Netskope, y compris les alertes de politique, DLP (Prévention des pertes de données) et les alertes de liste de surveillance. Les alertes relatives à la politique sont déclenchées lorsque le trafic correspond à la politique. Les alertes DLP (Prévention des pertes de données) sont générées lorsqu'il y a une violation DLP (Prévention des pertes de données) déclenchée par la politique. Les alertes de la liste de surveillance sont déclenchées lorsque la liste de surveillance correspond.
Point final de la demande
https://<tenant-URL>/api/v1/alerts
Valid query parameters are:
| Clé | Value | Description |
|---|---|---|
token | string | Il s'agit d'une obligation. Le jeton obtenu sur la page de l'API REST dans l'interface utilisateur de Netskope ( Settings > Tools > Rest API v1) est nécessaire. Nous vous recommandons de placer le jeton dans le corps de la demande, et non dans l'URL du point final. |
query | Valid alert query. Exemples :
| Il s'agit d'un filtre pour toutes les alertes de l'application en nuage dans la base de données des événements. |
type | anomaly | 'Compromised Credential' | policy | 'Legal Hold' | malsite | Malware | DLP | 'Security Assessment' | watchlist | quarantine | Remediation | uba | Sélectionne les alertes Policy, DLP (Prévention des pertes de données), Quarantaine, Watchlist, etc. Si rien n'est transmis, il reçoit des alertes de tous types. |
acked | true | false | Sélectionne le type d'alertes. Si rien n'est transmis, il reçoit des alertes de tous types. |
timeperiod | 3600 | 86400 | 604800 | 2592000 | Dernières 60 minutes | Dernières 24 heures | Derniers 7 jours | Derniers 30 jours | Derniers 60 jours | Derniers 90 jours N'utilisez qu'un seul de ces paramètres à la fois, pas une combinaison : |
starttime | Heure de l'époque Unix | Limitez les alertes à celles dont l'heure est supérieure à cette valeur. Nécessaire uniquement si timeperiod ou insertionstarttime/insertionendtime n'est pas transmis.N'utilisez qu'un seul de ces paramètres à la fois, pas une combinaison : |
endtime | Heure de l'époque Unix | Limitez les alertes à celles dont l'heure est inférieure ou égale à cette valeur. Nécessaire uniquement si timeperiod ou insertionstarttime/insertionendtimen'est pas transmis. |
insertionstarttime | Heure de l'époque Unix | Restreindre les alertes qui ont été insérées dans la base de données après le délai spécifié. Nécessaire uniquement si timeperiod ou starttime/endtime n'est pas transmis.N'utilisez qu'un seul de ces paramètres à la fois, pas une combinaison : |
insertionendtime | Heure de l'époque Unix | Restreindre les alertes qui ont été insérées dans la base de données avant l'heure spécifiée. Nécessaire uniquement si timeperiod ou starttime/endtime n'est pas transmis. |
limit | Entier positif inférieur à 5000 | Les réponses de l'API REST peuvent renvoyer jusqu'à 10000 alertes dans une seule réponse. Vous pouvez utiliser la pagination pour obtenir davantage de résultats. |
skip | Nombre entier positif | Ignorer certaines alertes (utile pour la pagination en combinaison avec limit). |
unsorted | true | false | Si true, les données renvoyées ne seront pas triées (utile pour améliorer les performances). |
Response
Pour plus d'informations sur les réponses, consultez les descriptions des réponses aux événements et alertes de l'API REST.
Exemples de demandes et de réponses
Filter by single Compliance Standard
POST 'https://<tenant-URL>/api/v1/alerts?timeperiod=86400&type=Security%20Assessment&limit=1&stimeperiod=2592000&query=%28compliance_standards.standard%20eq%20%27CSA-CCM-3.0.1%27%29
{
"token": "f32a973eddd7bc1602fc0f48dc0a"
}
{
"alert_type": "Security Assessment",
"region_id": "westeurope",
"sa_profile_name": "CIS Azure Foundations Benchmark v1.0.0",
"app": "Microsoft Azure",
"object_type": "Instance",
"compliance_standards": [
{
"control": "02",
"description": "Security Incident Management, E-Discovery, & Cloud Forensics: Incident Management | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.",
"section": "SEF",
"standard": "CSA-CCM-3.0.1",
"reference_url": "https://cloudsecurityalliance.org/research/cloud-controls-matrix/",
"id": -91402
}
],
"account_name": "iaas-qe",
"region_name": "West Europe",
"category": "IaaS/PaaS",
"timestamp": 1603870162,
"sa_profile_id": -2001000,
"sa_rule_id": -2067,
"iaas_remediated": "false",
"access_method": "API Connector",
"policy": "azure_81_policy",
"sa_rule_name": "Personnel know response roles/operations: Ensure that 'Send Alerts to' is set for SQL Servers",
"type": "nspolicy",
"account_id": "e3813397-1fff-46b0-a59f-5c2130aac115",
"iaas_asset_tags": [],
"sa_rule_severity": "High",
"object": "automation1603868619",
"alert": "yes",
"user": "admin@netskope.com",
"device": "other",
"count": 1,
"asset_object_id": "016044c5aeb1bf9c3af75357",
"instance_id": "azure80",
"alert_name": "Personnel know response roles/operations: Ensure that 'Send Alerts to' is set for SQL Servers",
"activity": "Introspection Scan",
"action": "alert",
"browser": "unknown",
"os": "unknown",
"resource_category": "Database",
"policy_id": 2,
"organization_unit": "",
"userkey": "admin@netskope.com",
"ur_normalized": "admin@netskope.com",
"site": "Windows Azure",
"traffic_type": "CloudApp",
"ccl": "excellent",
"acked": "false",
"_insertion_epoch_timestamp": 1603967916,
"_id": "d3a03deeb9ec657d18f48a43",
"cci": 96,
"sa_rule_remediation": "<html>nt<body>nt <b>Azure Console:</b>n <ol>n <li>Go to <code>SQL servers</code></li>n <li>For each server instance</li>n <li>Click on <code>Auditing & Threat Detection</code></li>n <li>Set <code>Send alerts to</code> as appropriate</li>n </ol>n n <b>Azure PowerShell:</b>n <p>n Get the list of all SQL Servers<br>n <code><pre>n Get-AzureRmSqlServern </pre></code>n For each Server, set <code>Send alerts to</code>.<br>n <code><pre>n Set-AzureRmSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -NotificationRecipientsEmails "<Recipient Email ID>"n </pre></code>n </p>n n <b>Default Value:</b><br>n <p>n By default, <code>Send alerts to</code> is not set.n </p>nt</body>n</html>n",
"appcategory": "IaaS/PaaS"
}
Filter by multiple Compliance Standards
POST 'https://<tenant-URL>/api/v1/alerts?timeperiod=2592000&query=%28compliance_standards.standard%20in%20%5B%27CSA-CCM-3.0.1%27%2C%20%27NIST-CSF-1.1%27%2C%20%27CIS-AZRFND-1.0.0%27%5D%29
{
"token": "f32a973eddd7bc1602fc0f48dc0a"
}
{
"alert_type": "Security Assessment",
"region_id": "westeurope",
"sa_profile_name": "CIS Azure Foundations Benchmark v1.0.0",
"app": "Microsoft Azure",
"object_type": "Instance",
"compliance_standards": [
{
"control": "02",
"description": "Security Incident Management, E-Discovery, & Cloud Forensics: Incident Management | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.",
"section": "SEF",
"standard": "CSA-CCM-3.0.1",
"reference_url": "https://cloudsecurityalliance.org/research/cloud-controls-matrix/",
"id": -91402
},
{
"control": "1",
"description": "Personnel know their roles and order of operations when a response is needed",
"section": "RS.CO",
"standard": "NIST-CSF-1.1",
"reference_url": "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf",
"id": -7701
},
{
"control": "1.4",
"description": "Ensure that 'Send alerts to' is set",
"appname": "azure",
"section": "4",
"standard": "CIS-AZRFND-1.0.0",
"reference_url": "https://www.cisecurity.org/benchmark/azure/",
"id": -5414
}
],
"account_name": "iaas-qe",
"region_name": "West Europe",
"category": "IaaS/PaaS",
"timestamp": 1603870162,
"sa_profile_id": -2001000,
"sa_rule_id": -2067,
"iaas_remediated": "false",
"access_method": "API Connector",
"policy": "azure_81_policy",
"sa_rule_name": "Personnel know response roles/operations: Ensure that 'Send Alerts to' is set for SQL Servers",
"type": "nspolicy",
"account_id": "e3813397-1fff-46b0-a59f-5c2130aac115",
"iaas_asset_tags": [],
"sa_rule_severity": "High",
"object": "automation1603868619",
"alert": "yes",
"user": "admin@netskope.com",
"device": "other",
"count": 1,
"asset_object_id": "016044c5aeb1bf9c3af75357",
"instance_id": "azure80",
"alert_name": "Personnel know response roles/operations: Ensure that 'Send Alerts to' is set for SQL Servers",
"activity": "Introspection Scan",
"action": "alert",
"browser": "unknown",
"os": "unknown",
"resource_category": "Database",
"policy_id": 2,
"organization_unit": "",
"userkey": "admin@netskope.com",
"ur_normalized": "admin@netskope.com",
"site": "Windows Azure",
"traffic_type": "CloudApp",
"ccl": "excellent",
"acked": "false",
"_insertion_epoch_timestamp": 1603967916,
"_id": "d3a03deeb9ec657d18f48a43",
"cci": 96,
"sa_rule_remediation": "<html>nt<body>nt <b>Azure Console:</b>n <ol>n <li>Go to <code>SQL servers</code></li>n <li>For each server instance</li>n <li>Click on <code>Auditing & Threat Detection</code></li>n <li>Set <code>Send alerts to</code> as appropriate</li>n </ol>n n <b>Azure PowerShell:</b>n <p>n Get the list of all SQL Servers<br>n <code><pre>n Get-AzureRmSqlServern </pre></code>n For each Server, set <code>Send alerts to</code>.<br>n <code><pre>n Set-AzureRmSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -NotificationRecipientsEmails "<Recipient Email ID>"n </pre></code>n </p>n n <b>Default Value:</b><br>n <p>n By default, <code>Send alerts to</code> is not set.n </p>nt</body>n</html>n",
"appcategory": "IaaS/PaaS"
}
Filtrer par type
POST 'https://<tenant-URL>/api/v1/alerts?timeperiod=86400&type=Security%20Assessment&limit=1&skip=0&ack=false'
{
"token": "f32a973eddd7bc1602fc0f48dc0a"
}
{
"msg" : "",
"data" : [
{
"app" : "Amazon Web Services",
"alert_name" : "CIS AWS Foundations Benchmark v1.2.0",
"instance_id" : "aws61",
"device" : "other",
"ccl" : "excellent",
"browser" : "unknown",
"organization_unit" : "",
"access_method" : "API Connector",
"_session_begin" : 1,
"sa_profile_name" : "CIS AWS Foundations Benchmark v1.2.0",
"acked" : "false",
"_id" : "1c248c457f5c2f2fb8b221f5",
"type" : "nspolicy",
"account_name" : "aws61",
"alert_type" : "Security Assessment",
"timestamp" : 1551713762,
"activity" : "Introspection Scan",
"object_type" : "Policy",
"compliance_standards": [
{
"control": "02",
"description": "Security Incident Management, E-Discovery, & Cloud Forensics",
"section": "SEF",
"standard": "CSA-CCM-3.0.1",
"reference_url": "https://cloudsecurityalliance.org/research/cloud-controls-matrix/",
"id": -91402
}
],
"user" : "meghana@netskope.com",
"alert" : "yes",
"userkey" : "meghana@netskope.com",
"sa_rule_remediation" : "<html>n<body>n <b>Using the Amazon unified command line interface:</b>n <ol>n <li>Create an IAM role for managing incidents with AWS:n <ul style='list-style-type: circle;'>n <li>Create a trust relationship policy document that allows <iam_user> to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json:</li>n <li>n <code>n {n 'Version': '2012-10-17',n 'Statement': [n {n 'Effect': 'Allow',n 'Principal': { 'AWS': '<iam_user>'n },n 'Action': 'sts:AssumeRole'n }n ]n }n </code>n </li>n </ul>n </li>n <li>n <ul style='list-style-type: circle;'>n <li>Create the IAM role using the above trust policy:</li>n <li>aws iam create-role --role-name <aws_support_iam_role> --assume-role- policy-document file:///tmp/TrustPolicy.json</li>n </ul>n </li>n <li>n <ul style='list-style-type: circle;'>n <li>Attach 'AWSSupportAccess' managed policy to the created IAM role:</li>n <li>aws iam attach-role-policy --policy-arn <iam_policy_arn> --role-name <aws_support_iam_role></li>n </ul>n </li>n </ol>n <p>n <b>Impact</b><br>n All AWS Support plans include an unlimited number of account and billing support cases,n with no long-term contracts.<br>n Support billing calculations are performed on a per-account basis for all plans. Enterprisen Support plan customers have the option to include multiple enabled accounts in ann aggregated monthly billing calculation.<br>n Monthly charges for the Business and Enterprise support plans are based on each month'sn AWS usage charges, subject to a monthly minimum, billed in advance<br>n </p> n</body>n</html>n",
"sa_rule_id" : -1001017,
"sa_rule_name" : "CIS-AWSFND | 1.22 Ensure a support role has been created to manage incidents with AWS Support",
"os" : "unknown",
"resource_category" : "Identity",
"object" : "arn:aws:iam::215406114230:policy/automation1551712932",
"policy" : "aws61policy",
"traffic_type" : "CloudApp",
"count" : 1,
"region_id" : "",
"policy_id" : 3,
"action" : "alert",
"sa_rule_severity" : "2",
"cci" : 94,
"account_id" : "215406114230",
"sa_profile_id" : -1001000,
"site" : "Amazon Web Services",
"appcategory" : null,
"_insertion_epoch_timestamp" : 1551713763,
"category" : null
}
],
"status" : "success"
}
Query for DLP violations grouped by user:
POST https://<tenant-URL>/api/v1/report?query=alert_type eq DLP&type=alert&groupby=user&timeperiod=2592000
- Définissez le nom du point de terminaison comme
report - Définissez
query=alert_type eq DLPpour demander des alertes DLP (Prévention des pertes de données). - Définissez
type=alert to querypour les alertes DLP (Prévention des pertes de données). - Set
groupby=user