Get Threats

Last Update

10/23/2018

Authentication

YES

HTTP Method

POST

Content Type

application/json

Rate limited

YES

Requests per rate limit

10/min

Response Format

JSON

access_token

string

URL

Yes

access token which archived from OAuth authentication step

id

string

Body

Yes

The Device ID or MAC Address of a device you want to fetch detected threats.

limit

int

URL

Optional

Specific maximum number of threats will be returned in the response.

The value should be in [1,50].

50

page

int

URL

Optional

Specific page number which threats will be returned in. If the requested page exceeds the number of pages of threats, error code will be 413. It means that the requested page number is too large, no devices will be returned in this case.

1

verbose

object

Body

Optional

Specify what information you look for

verbose. antimalware_scan

int

Body

Optional

Specify if threats detected by daily anti-malware scan are included in the response Values can be:

• 0: not include

• 1: include

1

verbose. local_antimalware_threats

int

Body

Optional

Specify if threats detected by local anti-malware products are included in the response Values can be:

• 0: not include

• 1: include

1

antimalware_scan

array<object>

verbose. antimalware_scan =1

An array of threats detected by daily anti-malware scan

antimalware_scan.critical

int

Indicate if the threat is critical based on the defined policy on MetaDefender IT Access console

Values are:

• 0 – not critical

• 1 – critical

antimalware_scan .scan_time

string

timestamp when found the threat

antimalware_scan .file

string

File was found the threat

antimalware_scan .hash

string

Indicates the hash code of the scanning object if the object is a file or process

antimalware_scan .threat_name

string

Threat name

antimalware_scan .details

array<object>

An array of threats found with details information

antimalware_scan .details.threat_name

string

Threat name which detected on a specific engine

antimalware_scan .details.av_name

string

Name of an engine which found the threat

local_antimalware_threats

array<object>

verbose. local_antimalware_threats =1

Lists of threats ( threat details detected by local anti-malware applications )

local_antimalware_threats .scan_time

string

Last timestamp when the threat was detected

local_antimalware_threats .repeat

int

Number of times the threat was detected

local_antimalware_threats .file

string

File was detected as a threat

local_antimalware_threats .threat_name

string

Threat name

local_antimalware_threats .product_name

string

product name which found the threat

local_antimalware_threats .product_vendor

string

Vendor name

local_antimalware_threats .product_version

string

Product version

local_antimalware_threats .action

string

Indicate an action the local anti-malware product took Value can be: unknown, cleaned, deleted, quarantined

local_antimalware_threats .existing

int

to indicate if an infected file still exists on the system when the agent report the data.

• 0 : not existing

• 1 : existing