ExtraHop Reveal(x) 360 プラグイン（リスクエクスチェンジ用）

使うAPI一覧

認証トークンを取得する

API Endpoint: /oauth2/token

Method: 役職

Headers

Params

Sample API Response

{
    "access_token": "eyJraWQiOiJkbndoem42RUNpaW9mSDRSTWdVV0FlZ1lhRHMrVlRDeDhXN1dJZnpVYjZjPSIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiIyYTFsN2ZkaGRxdHR1YzlpcXBzamd1bHNpcSIsInRva2VuX3VzZSI6ImFjY2VzcyIsInNjb3BlIjoiY2NwXC9kZXRlY3Rpb25fYWNjZXNzX2xldmVsLmZ1bGwgY2NwXC9ucG1fYWNjZXNzX2xldmVsLm5vbmUgY2NwXC9wYWNrZXRzX2xldmVsLm5vbmUgY2NwXC93cml0ZV9sZXZlbC5mdWxsX3JlYWRvbmx5IiwiYXV0aF90aW1lIjoxNjk3OTgzNzAxLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAudXMtd2VzdC0yLmFtYXpvbmF3cy5jb21cL3VzLXdlc3QtMl85YU9FMWltMXIiLCJleHAiOjE2OTc5ODQzMDEsImlhdCI6MTY5Nzk4MzcwMSwidmVyc2lvbiI6MiwianRpIjoiNTllMjc0ZGItMTYxMS00MDRjLTk1NzgtZWJiNDQwZmE5ZTU3IiwiY2xpZW50X2lkIjoiMmExbDdmZGhkcXR0dWM5aXFwc2pndWxzaXEifQ.pw-cbQTSVC1HlRdl_v63s3wbHnqsDNfVJ1Ln9H0GsJvHENKG5borLHIPTsquhov6rEmmzzs6NxMhX5VFY0dH0XWgmrV5BFN4Q5vASQ2lZVY_1NjEqYsJAcVLrzmxy7TqMN_L7kuoX5ijN_mAezxwfnj4hQfrd1ojUVt7_wzSUIVpZy6dDARs1EdrrFAZw70zXW7vTUlzhkiqMthAwD2TaoxOcewHFlC3lgvIjz_DoEYUB09qsP0EJ4oQNaCxetJjPkddN2DqVXEnAi5Jvz6fILbT-wFWua-AEBvk-GXGMXBUKCYs4g-ZvnWnSpcfsMAJZTTOO-05qpbnYE-K3N7qOQ",
    "expires_in": 600,
    "token_type": "Bearer"
}

フェッチ検出

API endpoint: /api/v1/detections/search

Method: 役職

Headers

Parameters

Sample API Response

[{
“id”: 12884903439,
“start_time”: 1725987480001,
“update_time”: 1725991200000,
“end_time”: 1725987570000,
“title”: “LDAP Invalid Credentials Error”,
“description”: “[jump\\.i\\.rx\\.tours](https://extrahop-bd.cloud.extrahop.com#/metrics/devices/fa60fb84b3594c9bb8262f88e90a2c8b.0ea3bf8493e10000/overview?from=1725987480&interval_type=DT&until=1725987570) received an unusually high number of LDAP errors for invalid credentials. This behavior indicates that the user is repeatedly trying to authenticate, or bind, with a wrong distinguished name (DN) or password, an expired password, or credentials for a locked account. Confirm if [jump\\.i\\.rx\\.tours](https://extrahop-bd.cloud.extrahop.com#/metrics/devices/fa60fb84b3594c9bb8262f88e90a2c8b.0ea3bf8493e10000/overview?from=1725987480&interval_type=DT&until=1725987570) is compromised and attempting a brute force attack.”,
“risk_score”: 60,
“type”: “ldap_invalid_credentials_error”,
“recommended_factors”: [
“critical_asset”,
“top_offender”
],
“recommended”: true,
“categories”: [
“sec.lateral”,
“perf.auth”,
“perf”,
“sec”,
“sec.attack”
],
“properties”: {},
“participants”: [
{
“role”: “offender”,
“scanner_service”: null,
“endpoint”: null,
“external”: false,
“object_id”: 12884901938,
“object_type”: “device”,
“id”: 6897
},
{
“role”: “victim”,
“scanner_service”: null,
“endpoint”: null,
“external”: false,
“object_id”: 12884901891,
“object_type”: “device”,
“object_value”: “10.1.1.10”,
“id”: 2258
}
],
“ticket_id”: null,
“assignee”: null,
“status”: null,
“resolution”: null,
“mitre_tactics”: [
{
“id”: “TA0006”,
“name”: “Credential Access”,
“url”: “https://attack.mitre.org/tactics/TA0006”
},
{
“id”: “TA0040”,
“name”: “Impact”,
“url”: “https://attack.mitre.org/tactics/TA0040”
}
],
“mitre_techniques”: [
{
“id”: “T1110”,
“name”: “Brute Force”,
“url”: “https://attack.mitre.org/techniques/T1110”,
“legacy_ids”: [
“T1110”
]
},
{
“id”: “T1531”,
“name”: “Account Access Removal”,
“url”: “https://attack.mitre.org/techniques/T1531”,
“legacy_ids”: [
“T1531”
]
}
],
“appliance_id”: 3,
“is_user_created”: false,
“mod_time”: 1725991298714,
“create_time”: 1725987562417,
“url”: “https://extrahop-bd.cloud.extrahop.com/extrahop/#/detections/detail/12884903439/?from=1725986580&until=1725988470&interval_type=DT”
}
]

デバイスの取得

API endpoint: /api/v1/devices/search

Method: 役職

Headers

Payload

Sample API Response

[{
“vpc_id”: “vpc-0788ce1ab062ee642”,
“cdp_name”: “”,
“custom_model”: null,
“analysis_level”: 1,
“custom_make”: null,
“default_name”: “ 0e257a0641670000”,
“mod_time”: 1726707648876,
“subnet_id”: “subnet-0aada065085d74814”,
“dhcp_name”: “ip-10-1-100-248”,
“custom_criticality”: null,
“vlanid”: 0,
“discover_time”: 1713979140000,
“vendor”: null,
“macaddr”: “0E:25:7A:06:41:67”,
“dns_name”: “”,
“user_mod_time”: 1713979265453,
“ipaddr4”: null,
“ipaddr6”: null,
“custom_type”: “file_server”,
“custom_name”: “ftp1.i.rx.tours”,
“cloud_account”: “423411706765”,
“auto_role”: “other”,
“role”: “file_server”,
“display_name”: “ftp1.i.rx.tours”,
“last_seen_time”: 1724960970000,
“on_watchlist”: false,
“critical”: false,
“discovery_id”: “0e257a0641670000”,
“node_id”: 3,
“extrahop_id”: “0e257a0641670000”,
“cloud_instance_name”: null,
“cloud_instance_description”: null,
“cloud_instance_type”: null,
“cloud_instance_id”: “i-099c43de3a51df856”,
“model_override”: null、
“model”: null、
“netbios_name”: “”,、
“device_class”: “node”,、
“is_l3”: false、
“parent_id”: null、
“FTPリプション”: “FTP Service”,、
“id”: 12884901926、
“analysis”: “advanced”
}
]