Malwarebytes Webhooks API

## Using WebhooksThreatDown can send webhook events that notify your application any time an event happens on your account.This is useful for transactions which are not reported synchronously to your code when performing an API call, or for security events happening in your endpoints.You can register multiple webhook handlers for any event. Any time an event occurs, we will send a `POST` request to any endpoint URLs you have registered for that event.## When to use WebhooksFor most requests, you don't need Webhooks. However, for all requests that involve asynchronous transactions, such as getting the report after a machine scan, you will need to register webhooks to get real-time notifications.The alternative to registering webhooks is performing polling, but this is deeply discouraged: besides involving more complicated code on your side, you may exceed your quota and consequently your API plan.## How to configure WebhooksThreatDown provides you with REST APIs for creating, retrieving, and deleting subscriptions. Currently, subscriptions can be registered only through APIs.## Handling Webhook notifications and respondingCreating a webhook handler on your server is no different from creating an API endpoint. Webhook data is sent as `JSON` data in the `POST` requests body. You can handle these requests and process data to fit your needs.To acknowledge receipt of a webhook notification, your server must return a `2xx` `HTTP` status code. All response codes outside this range, including `3xx`, will be threatened as failures and we will try sending these notifications again using exponential backoff for calculating the delay between requests. The default maximum number of retries is `5`. You can configure the `max_retries` parameter when registering a new subscription to customize this behavior.If your endpoint keeps responding with a status code outside the `2xx` range, after the default number of `maxAttempts`, we will stop sending the webhook notification. You will be responsible for reconciling your data by querying our API endpoints for potentially missed events.We recommend you design idempotent event processing because you might receive the same event more than once.## How to verify Webhooks originThreatDown will sign the webhook events it sends to your server. We do so by including a signature in each event’s `X-MWB-Signature` header. This allows you to validate that the events were sent by ThreatDown and not by a third party.To protect your server from bad senders:- When you create a webhook subscription, you can supply an additional `secret_token` parameter. We will use that parameter as the signing key to generate an `HMAC` of the payload.- When you receive a webhook event, extract the request's body and compute:```HMAC_SHA256(secret_token, webhookPayload)````secret_token` is the shared secret you configured when creating a subscription.- compare your result with the value of `X-MWB-Signature`. If those match, you can assume the notification was sent by ThreatDown.## Supported eventsThe supported events are:- job_status_change- detection- machine_events- threat_events- agent_events- quarantine_events- edr_events- syslog_events- exclusion_events- scheduled_events- policy_events- user_events- drive_events- cve_events- dns_events- license_events- appblock_events- endpoint_events## Events modelWhen ThreatDown sends a webhook notification, it wraps the notification in an envelope in order to supply additional metadata. When you receive a webhook notification, expect the following data posted in the request body:| Name | Description | Type ||------|-------------|-------|| event| The event type. | string, one of supported events type listed above || subscription_id | Unique identifier of the subscription that matched this event | string || account_id | Nebula account id (site) generating this event | string || payload | An object containing the event-specific data | object |**When you receive a webhook notification, you usually switch your processing logic depending on the value of the `event` property, which represents the event type. Depending on the value, the `payload` sent will have a different model. Refer to specific models below:**### job_status_changeThe `job_status_change` event is sent when a job you issue through the `Jobs` APIs, change its status.This allow you to track, for example, completed or failed scans.The payload includes the following parameters:| Name | Description | Type ||------|-------------|-------|| id | Unique identifier of the job | string || machine_id | Unique identifier of the endpoint | string || command | Type of command. See the `Job` API for more info | string || issued_by | User issuing the job. This is of your interest only if you use Nebula through cloud console UI as well | string || status | Status of the job. It can be one of `PENDING`, `STARTED`, `TIMED_OUT`, `COMPLETED`, `EXPIRED`, `FAILED`. | string || relay_state | The relay state if you supplied one when issuing the job | string || data | Job's settings. See the `Job` API for more info | object || created_at | Timestamp indicating when the job was created | string || updated_at | Timestamp indicating when the job was last updated | string || expires_at | Timestamp indicating when the job expires | string |Example:```json{ "event":"job_status_change", "id":"cdf5f8e6-a3d0-4c33-a506-3c6cbce7bf0b", "payload":{ "machine_id":"cf1ed661-812c-4342-9dc7-c806b90072c3", "issued_by":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "expires_at":"2020-08-31T11:22:31.624139429Z", "command":"command.asset.refresh", "data":"{}", "status":"CREATED", "id":"2c74da91-6e73-4867-8736-ca4b1f8effda", "updated_at":"2020-08-28T11:22:31.625274922Z", "created_at":"2020-08-28T11:22:31.624138004Z" }, "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id":"f43dc73b-2709-4d6f-9c79-08abc815114b"}```### DetectionThe `detection` event is sent when ThreatDown finds one or more threats in your endpoints.The payload includes the following parameters:| Name | Description | Type ||------|-------------|-------|| id | Unique identifier of the detection | string || machine_id | Unique identifier of the endpoint where the detection happened | string || machine_name | Name of the endpoint where the detection happened | string || scan_id | Unique identifier of the scan triggering the detection | string || group_id | Unique identifier of the group to which the endpoint belongs | string || group_name | Name of the group to which the endpoint belongs | string || policy_id | Unique identifier of the policy assigned to the endpoint | string || policy_name | Name of the policy assigned to the endpoint | string || detection_id | Unique identifier of the detection as reported by the endpoint agent | string || scanned_at | Timestamp of the scan (as received by the server) | string || scanned_at_local | Timestamp of the scan (as reported by the endpoint agent) | string || reported_at | Timestamp of when the detection was reported | string || status | The status of the detection (i.e. `blocked`, `quarantined`) | string || threat_name | Name of the threat | string || type | Type of the threat | string || path | Path where the threat was found | string || category | Category of the threat | string || ip_address | IP address of the detection, when applicable | string || url | URL of the detection, when applicable | string || port | Port of the detection, when applicable | string || affected_application | Affected application, when applicable | string || md5 | Hash of the file, when applicable | string || process_name | Name of the process, when applicable | string |### Policy Events#### Policy Updated```json{ "event":"policy_events", "id":"a8accc52-9f8c-4319-a2fd-975641f0ba7d", "payload":{ "severity":"AUDIT", "type":"POLICY_UPDATED", "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "details":{ "message":"Policy Updated", "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "user_email":"example@example.com", "user_name":"Mister User", "user_role":"Super Admin", "policy_id":"870de3fa-073e-468f-8d3a-a7edddeae594", "policy_name":"Aggressive Policy", "ip_address":"37.157.101.160" }, "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "id":"579b0361-3e3f-4ab0-8453-84fc0f36f4e6", "created_at":"2020-08-28T10:35:32.637936426Z" }, "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id":"f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### Policy Created```json{ "event":"policy_events", "id":"40662e4a-60c7-4920-b788-59af13c2c23d", "payload":{ "severity":"AUDIT", "type":"POLICY_CREATED", "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "details":{ "message":"Policy Created", "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "user_email":"example@example.com", "user_name":"Mister User", "user_role":"Super Admin", "policy_id":"b3bdce6e-a055-4246-b3a3-08237db82c9d", "policy_name":"My new Policy", "ip_address":"37.157.101.160" }, "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "id":"c8e4d487-8167-4a46-8bf2-c6ee331abd1b", "created_at":"2020-08-28T11:01:49.015472172Z" }, "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id":"f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### Policy Deleted```json{ "event":"policy_events", "id":"4a88d17d-3f48-452e-a871-32584d9b26cf", "payload":{ "severity":"AUDIT", "type":"POLICY_DELETED", "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "details":{ "message":"Policy Deleted", "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "user_email":"example@example.com", "user_name":"Mister User", "user_role":"Super Admin", "policy_id":"b3bdce6e-a055-4246-b3a3-08237db82c9d", "policy_name":"My new Policy", "ip_address":"37.157.101.160" }, "user_id":"86d6c44f-2d0d-4225-b1f7-23f47b5d1a7b", "id":"ef09a4a9-5c9f-481c-beb6-4757ede35dc3", "created_at":"2020-08-28T11:03:15.655679621Z" }, "account_id":"550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id":"f43dc73b-2709-4d6f-9c79-08abc815114b"}```### Machine Events#### Machine registered```json{ "event":"machine_events", "id":"43c1fbfd-788a-4839-86b6-b765dfdc59d5", "payload":{ "severity":"AUDIT", "type":"MACHINE_REGISTERED", "machine_id":"0eed4a65-81a9-4cae-91e6-d8cd8dbd775a", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"My PC", "details":{ "message":"New machine registered" }, "id":"ccb84b33-2d8e-4dcb-94a0-922fc669ce4a", "created_at":"2020-08-28T11:28:05.083699037Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"5032842b-0dd1-44f4-a59e-feadc22c142d"}```#### Machine unregistered```json{ "event": "machine_events", "id": "3883b459-b3c8-40d5-999a-18514f1a3db0", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "payload": { "severity": "AUDIT", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "machine_id": "d5536936-941a-4e12-9e62-b11cda0f39a6", "id": "d7653c62-eb23-4163-8cfc-43ef69aea9ad", "created_at": "2022-03-30T13:11:52.925005454Z", "machine_name": "LeBlanc", "details": { "message": "machine unregistered", "timeout": false }, "type": "MACHINE_UNREGISTERED" }, "subscription_id": "3dc2a8d9-eb83-4127-afff-8fefa04f58e1"}```#### Machine asset info```json{ "event":"machine_events", "id":"9ecdd1c2-eb50-4baa-be81-823897ebd55e", "payload":{ "severity":"INFO", "type":"MACHINE_ASSET_INFO", "machine_id":"cf406788-edea-4938-b0db-757379d21e11", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"Asset information received" }, "id":"93ba7d7c-fcf4-43fd-9df8-8d857d6d3cd0", "created_at":"2020-08-28T11:29:08.290089258Z" }}```#### Machine group changed```json{ "event":"machine_events", "id":"7541515f-95f7-49d3-8913-9cb31c0aa927", "payload":{ "severity":"AUDIT", "type":"MACHINE_GROUP_CHANGED", "machine_id":"36b53eb8-45f0-46c7-a395-1aa361f09021", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"NewEndpoint moved from Default Group to New Test Group ihg21jhkee5mhmr", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "machine_id":"36b53eb8-45f0-46c7-a395-1aa361f09021", "machine_name":"NewEndpoint" }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"d9613bf2-e5c5-4bce-9bf8-e138c792bc6b", "created_at":"2020-08-28T11:30:09.249131849Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"5032842b-0dd1-44f4-a59e-feadc22c142d"}```#### Machine alias created```json{ "event": "machine_events", "id": "50be8bed-d2e9-4a85-9bfa-6ccecd98137e", "payload": { "severity": "INFO", "type": "MACHINE_ALIAS_CREATED", "account_id": "08496dca-fc09-4757-9573-c033ce078985", "user_id": "ea1b004e-5fd2-4fbc-bf09-5a00023704d0", "id": "659dc314-a9a0-41c5-bde4-26f293947ede", "created_at": "2021-03-01T10:19:31.732122237Z", "details": { "machine_id": "dc190e62-5424-4975-9913-1d84aec39300", "new_alias": "Endpoint name" } }, "account_id": "08496dca-fc09-4757-9573-c033ce078985", "subscription_id": "95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c"}```#### Machine alias changed```json{ "event": "machine_events", "id": "5563e7f9-3d04-48f0-b276-531fdff0b637", "payload": { "severity": "INFO", "type": "MACHINE_ALIAS_CHANGED", "account_id": "08496dca-fc09-4757-9573-c033ce078985", "user_id": "ea1b004e-5fd2-4fbc-bf09-5a00023704d0", "id": "e38e8b75-a0e5-4794-bb05-f3ee4d5deed8", "created_at": "2021-03-01T10:19:32.14157065Z", "details": { "machine_id": "dc190e62-5424-4975-9913-1d84aec39300", "old_alias": "Endpoint name", "new_alias": "Changed endpoint name" } }, "account_id": "08496dca-fc09-4757-9573-c033ce078985", "subscription_id": "95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c"}```#### Machine alias deleted```json{ "event": "machine_events", "id": "6b30f551-2f7a-4170-bf7b-0a1175ad10df", "payload": { "severity": "INFO", "type": "MACHINE_ALIAS_DELETED", "account_id": "08496dca-fc09-4757-9573-c033ce078985", "user_id": "ea1b004e-5fd2-4fbc-bf09-5a00023704d0", "id": "6b84564f-503d-4c60-bae7-c54f8092911b", "created_at": "2021-03-01T10:19:59.212023675Z", "details": { "machine_id": "8b18023a-d108-420d-b435-c4b0132c1a6e", "old_alias": "New endpoint name" } }, "account_id": "08496dca-fc09-4757-9573-c033ce078985", "subscription_id": "95dbb4e0-3cf2-4d81-a312-2ea6b6e7202c"}```### Exclusion events#### Exclusion created```json{ "event":"exclusion_events", "id":"3a1ff38c-0246-42e6-a859-06cfa4a3d4db", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_CREATED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"An Exclusion was Added", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_type":1, "exclusion_value":"C:/testCreateExclusion/happypathihg21jhkee5l5na.txt", "global_exclusion":true }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"cfe2c8ae-6803-4c24-9f35-dfea16e902d9", "created_at":"2020-08-28T11:29:06.745315507Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```#### Exclusion updated```json{ "event":"exclusion_events", "id":"f6080c78-4d52-4593-935d-c33a85c7cd44", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_UPDATED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"An Exclusion was Edited", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_type":6, "exclusion_value":"https://www.malwarebytesihg21jhkee5lbib.com/", "global_exclusion":true }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"31243b63-9b24-4dc9-b7f3-d5e2eb210496", "created_at":"2020-08-28T11:29:14.236333504Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```#### Exclusion enabled```json{ "event":"exclusion_events", "id":"f1277c42-8fb6-4615-ba3d-b4cdb00b1e78", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_ENABLED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"An Exclusion was Enabled", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_type":6, "exclusion_value":"https://www.malwarebytesihg21jhkee5lh9c.com/", "global_exclusion":true }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"2833e903-955a-48a3-8a5d-8e05c1e8f75f", "created_at":"2020-08-28T11:29:21.690971637Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```#### Exclusion deleted```json{ "event":"exclusion_events", "id":"7ba0355e-44d9-4f5c-a5a0-2884b783c465", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_DELETED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"An Exclusion was Deleted", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_type":1, "exclusion_value":"C:/testCreateExclusion/happypathihg21jhkee5ls7x.txt", "global_exclusion":true }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"03fc92e0-4e17-4ab8-9b85-cd74fa521660", "created_at":"2020-08-28T11:29:36.655423399Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```#### Exclusion disabled```json{ "event":"exclusion_events", "id":"f54f8b33-95ba-4591-96f8-d3dbfce7264d", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_DISABLED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"An Exclusion was Disabled", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_type":6, "exclusion_value":"https://www.malwarebytesihg21jhkee5ln0w.com/", "global_exclusion":true }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"126430b1-8d09-4356-8533-524231a7aee9", "created_at":"2020-08-28T11:29:29.158586114Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```#### Exclusion bulk delete```json{ "event":"exclusion_events", "id":"1bf018a2-d93e-48a5-be17-579f1f4c8bac", "payload":{ "severity":"AUDIT", "type":"EXCLUSION_BULK_DELETED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"Bulk Exclusions were Deleted", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "user_role":"Super Admin", "exclusion_count":2 }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"a0d18178-f772-48bd-bc12-8c421b4dacc1", "created_at":"2020-08-28T11:29:45.054762536Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf65f446-e88f-409e-accf-de7f371013a2"}```### Threat events#### Threat found```json{ "event":"threat_events", "id":"ebaef39a-40fd-4575-9fe7-2e07fd04d76f", "payload":{ "severity":"SEVERE", "type":"THREAT_FOUND", "machine_id":"b11220d5-60f5-4f25-adf1-03bebd14f2f2", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"Webhook validator", "details":{ "message":"Scan event notification" }, "id":"5984e884-8f7b-407a-892e-51bea5fa86e2", "created_at":"2020-08-28T11:29:08.496072781Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```#### Threat scan success```json{ "event":"threat_events", "id":"8eb6aabb-9a70-44d8-b767-5ceedf80893b", "payload":{ "severity":"INFO", "type":"THREAT_SCAN_SUCCESS", "machine_id":"b11220d5-60f5-4f25-adf1-03bebd14f2f2", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"Webhook validator", "details":{ "message":"Threat scan result received" }, "id":"10032184-9bfb-42b0-aab1-678b5cef859f", "created_at":"2020-08-28T11:29:08.46647437Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```#### Threat cleaned```json{ "event":"threat_events", "id":"a01f1de7-a072-4a98-b728-425706318cf8", "payload":{ "severity":"WARNING", "type":"THREAT_CLEANED", "machine_id":"06667ced-ed77-4cb5-bf17-ab45a6457ec6", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"Scan event notification", "scan_id":"4169c48d-2c03-40fd-8965-240e6d6b94f9", "scan_type":"ThreatScan", "group_name":"Default Group", "group_id":"513cf384-d53d-44b9-9813-db69a0e12d16", "policy_id":"138d00b0-05d0-4370-bd0e-d8b9db66dd0f", "policy_name":"Default Policy", "detections_found":0, "detections_cleaned":1, "scan_date":"2020-08-28T11:29:25Z", "scan_date_offset_seconds":0, "domain":"corp.mb-test.com", "ip_addresses":[ "10.100.136.53" ], "detections":[ { "id":"544064a5-b1bb-439b-b4df-2536d5949cfe", "trace_id":"4169c48d-2c03-40fd-8965-240e6d6b94f9_7fccf164-95bd-4035-a9bc-48a6dcf510c8", "scan_id":"4169c48d-2c03-40fd-8965-240e6d6b94f9", "machine_id":"06667ced-ed77-4cb5-bf17-ab45a6457ec6", "machine_name":"NewEndpoint", "group_id":"513cf384-d53d-44b9-9813-db69a0e12d16", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "detection_id":"7fccf164-95bd-4035-a9bc-48a6dcf510c8", "parent_detection_id":"", "correlation_hash":"", "scanned_at":"2020-08-28T11:29:25Z", "scanned_at_offset_seconds":0, "reported_at":"2020-08-28T11:29:26.138544Z", "cleaned_at":"0001-01-01T00:00:00Z", "status":"quarantined", "threat_name":"PUP.Optional.FooBar", "type":"WyJmaWxlIl0=", "path":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\c8e09e6a-6619-44f3-9b5c-f7a15d258aeb.EXE", "category":"PUP", "is_rtp_stream_event":false, "affected_application":"", "md5":"", "process_name":"", "GroupName":"", "PolicyID":"", "PolicyName":"", "CurrentGroupID":"00000000-0000-0000-0000-000000000000" } ] }, "id":"26c47666-02a2-452c-b382-07942372d0df", "created_at":"2020-08-28T11:29:26.191675412Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```#### Threat remediate success```json{ "event":"threat_events", "id":"2cc1807e-9b33-4de0-9d50-c240839bc79a", "payload":{ "severity":"INFO", "type":"THREAT_REMEDIATE_SUCCESS", "machine_id":"a0f29eef-257a-4101-a814-074ee462c949", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"" }, "id":"155f60f3-8128-446c-b409-580fad9b247f", "created_at":"2020-08-28T11:30:31.264848509Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```#### Threat remediate failure```json{ "event":"threat_events", "id":"99def8df-e1c7-4558-9287-009d3d87949e", "payload":{ "severity":"INFO", "type":"THREAT_REMEDIATE_FAILURE", "machine_id":"40919ac8-a2cd-458d-ba49-8af92c19ca54", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"" }, "id":"22f8269a-8e1f-4b22-a29a-b7d16b6bc376", "created_at":"2020-08-28T11:30:57.669921894Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```#### Threat found```json{ "event":"threat_events", "id":"d9cd9bc7-b5c2-49b3-88ca-9682ffe015ca", "payload":{ "severity":"SEVERE", "type":"THREAT_FOUND", "machine_id":"58e326bc-de1f-49a6-926f-def0065275b3", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"Scan event notification", "scan_id":"1dad28d1-7a34-40df-96dc-4ee9781e9363", "scan_type":"ThreatScan", "group_name":"Default Group", "group_id":"513cf384-d53d-44b9-9813-db69a0e12d16", "policy_id":"138d00b0-05d0-4370-bd0e-d8b9db66dd0f", "policy_name":"Default Policy", "detections_found":1, "detections_cleaned":0, "scan_date":"2020-08-28T11:29:25Z", "scan_date_offset_seconds":0, "domain":"corp.mb-test.com", "ip_addresses":[ "10.100.136.53" ], "detections":[ { "id":"e659d7d7-7bc3-49e2-b3e7-7a44bf37753e", "trace_id":"1dad28d1-7a34-40df-96dc-4ee9781e9363_f596c2bf-f55c-4fa9-8dfa-17861ca8e84b", "scan_id":"1dad28d1-7a34-40df-96dc-4ee9781e9363", "machine_id":"58e326bc-de1f-49a6-926f-def0065275b3", "machine_name":"NewEndpoint", "group_id":"513cf384-d53d-44b9-9813-db69a0e12d16", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "detection_id":"f596c2bf-f55c-4fa9-8dfa-17861ca8e84b", "parent_detection_id":"", "correlation_hash":"", "scanned_at":"2020-08-28T11:29:25Z", "scanned_at_offset_seconds":0, "reported_at":"2020-08-28T11:29:25.763388Z", "cleaned_at":"0001-01-01T00:00:00Z", "status":"found", "threat_name":"PUP.Optional.FooBar", "type":"WyJmaWxlIl0=", "path":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\80febe47-44fe-4b5e-9549-4677b5d8dc8d.EXE", "category":"PUP", "is_rtp_stream_event":false, "affected_application":"", "md5":"", "process_name":"", "GroupName":"", "PolicyID":"", "PolicyName":"", "CurrentGroupID":"00000000-0000-0000-0000-000000000000" } ] }, "id":"41668db4-af52-4547-84eb-f68a4ed55cb2", "created_at":"2020-08-28T11:29:25.818909871Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"820e96cd-0fd4-4ed7-af74-8d1896322a3a"}```### EDR events#### Suspicious activity detection```json{ "event": "edr_events", "id": "48d1658e-87d8-4df4-87a8-27cecded2174", "payload": { "severity": "WARNING", "type": "EDR_SUSPICIOUS_ACTIVITY", "account_id": "683645cb-edf4-4a81-aa1f-efd87c53851d", "machine_id": "3a89e0b2-47db-4fe2-b6ba-8cd520bc5833", "id": "31cc7f69-4def-4291-89b8-6f7defb5b702", "created_at": "2021-03-10T15:09:45.055891846Z", "details": { "message": "C:\\REG-DISABLE-CMD359B71O4LKM3KQO3G.EXE" }, "machine_name": "NewEndpoint" }, "account_id": "683645cb-edf4-4a81-aa1f-efd87c53851d", "subscription_id": "c817dbda-95f5-4956-a6db-cc070ff0bd6d"}```#### Restore success```json{ "event":"edr_events", "id":"ae69d649-bd12-4948-9c98-342ba890f9a3", "payload": { "severity":"INFO", "type":"EDR_RESTORE_SUCCESS", "machine_id":"7f0d7483-92a8-4da5-9754-f7c16e4c3105", "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "details":{"message":""}, "id":"64a6fdef-31f1-4ec8-8c2a-a3d2c2f1f290", "machine_name":"NewEndpoint", "created_at":"2020-08-31T10:51:50.396082575Z" }, "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id":"ea725d97-11c2-4a34-9022-221b347c731d"}```#### Restore failure```json{ "event":"edr_events", "id":"9abec3e1-99ec-4af6-9ef1-e56453b402e8", "payload": { "severity":"INFO", "type":"EDR_RESTORE_FAILURE", "machine_id":"a207f475-7e6d-4c0d-8664-f8ddb6c1bb8a", "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "details":{"message":""}, "id":"1ae86c7a-9b45-4f8d-800b-cc5885964737", "machine_name":"NewEndpoint", "created_at":"2020-08-31T10:52:16.910215996Z" }, "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id":"ea725d97-11c2-4a34-9022-221b347c731d"}```#### Isolation success```json{ "event":"edr_events", "id":"7866c914-b4f9-4e99-8002-501079b2ca86", "payload": { "severity":"INFO", "type":"EDR_ISOLATION_SUCCESS", "machine_id":"f468073b-8715-49e4-a51f-903b86d8a57e", "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "details":{ "message":"Endpoint isolation succeeded" }, "id":"1c2b8b90-56d5-4bfd-97c1-073b0a4ea184", "machine_name":"NewEndpoint", "created_at":"2020-08-31T10:52:43.345700926Z" }, "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id":"ea725d97-11c2-4a34-9022-221b347c731d"}```#### Isolation failure```json{ "event":"edr_events", "id":"b7265e89-c05f-4c9f-bc1b-d5ef1cbf2439", "payload":{ "severity":"INFO", "type":"EDR_ISOLATION_FAILURE", "machine_id":"0361f318-4f01-4cef-8c5b-580f721eae8f", "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "details":{ "message":"Endpoint isolation failed" }, "id":"c64d1c74-8cf5-4afa-91ec-23e87c735b05", "machine_name":"NewEndpoint", "created_at":"2020-08-31T10:53:09.878218526Z" }, "account_id":"caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id":"ea725d97-11c2-4a34-9022-221b347c731d"}```#### Unisolation success```json{ "event": "edr_events", "id": "002e4f0a-2911-4ccb-aeb6-08d4ee5696de", "payload": { "severity": "INFO", "type": "EDR_UNISOLATION_SUCCESS", "machine_id": "f1e3a297-0039-4fb6-b736-e14e10a7b3c7", "account_id": "caef93d6-92bc-4731-a51f-f61685cca765", "details": { "message": "Endpoint un-isolation succeeded" }, "id": "5d8f7034-1d4c-4551-a4f7-d54d85de4dcd", "machine_name": "NewEndpoint", "created_at": "2020-08-31T10:53:36.517826109Z" }, "account_id": "caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id": "ea725d97-11c2-4a34-9022-221b347c731d"}```#### Unisolation failure```json{ "event": "edr_events", "id": "0c3b07b2-4a3f-4b88-9d60-314d0fdf8314", "payload": { "severity": "INFO", "type": "EDR_UNISOLATION_FAILURE", "machine_id": "0f92d8e2-c9a1-4666-9e05-deb63a139ca7", "account_id": "caef93d6-92bc-4731-a51f-f61685cca765", "details": { "message": "Endpoint un-isolation failed" }, "id": "60ed3071-19d3-4d56-8818-842666d356e6", "machine_name": "NewEndpoint", "created_at": "2020-08-31T10:54:03.055317564Z" }, "account_id": "caef93d6-92bc-4731-a51f-f61685cca765", "subscription_id": "ea725d97-11c2-4a34-9022-221b347c731d"}```### Syslog events#### Communication endpoint added```json{ "event":"syslog_events", "id":"59936c65-d1ad-4fb9-8e6f-191a7dc94d4c", "payload":{ "severity":"AUDIT", "type":"SYSLOG_COMMUNICATION_ENDPOINT_ADDED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Added Syslog Communication Endpoint", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "machine_id":"e21c1572-cbf5-4f41-a8f2-f520b752b244", "machine_name":"NewEndpoint" }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"4663c1b1-86ba-4ae8-aab9-bbb33892bdc0", "created_at":"2020-08-28T11:29:26.553694088Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"d5d7d7aa-43f0-483a-913a-49f3e282b964"}```#### Communication endpoint removed```json{ "event":"syslog_events", "id":"5e3a440b-b6b3-4c17-a6af-1593419ceecc", "payload":{ "severity":"AUDIT", "type":"SYSLOG_COMMUNICATION_ENDPOINT_REMOVED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Removed Syslog Communication Endpoint", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "machine_id":"e21c1572-cbf5-4f41-a8f2-f520b752b244", "machine_name":"NewEndpoint" }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"dd6ccb44-0cfb-4c92-8080-2b77637e809a", "created_at":"2020-08-28T11:29:33.371490102Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"d5d7d7aa-43f0-483a-913a-49f3e282b964"}```#### Communication endpoint disabled```json{ "event":"syslog_events", "id":"22c64b19-2a10-429f-b785-4db3ea0876bb", "payload":{ "severity":"AUDIT", "type":"SYSLOG_COMMUNICATION_ENDPOINT_DISABLED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Disabled Syslog Communication Endpoint", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "machine_id":"e21c1572-cbf5-4f41-a8f2-f520b752b244", "machine_name":"NewEndpoint" }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"e4856d8e-c00f-4e96-a1e2-58d89bed0813", "created_at":"2020-08-28T11:29:40.182107484Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"d5d7d7aa-43f0-483a-913a-49f3e282b964"}```#### Communication endpoint enabled```json{ "event":"syslog_events", "id":"552c6be3-fdf2-4350-9a2e-1f90fa5feb39", "payload":{ "severity":"AUDIT", "type":"SYSLOG_COMMUNICATION_ENDPOINT_ENABLED", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "details":{ "message":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com Enabled Syslog Communication Endpoint", "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "user_email":"tagalileogalilei+ihg21jbkee5i0f0@gmail.com", "user_name":"Webhooks Tests", "machine_id":"e21c1572-cbf5-4f41-a8f2-f520b752b244", "machine_name":"NewEndpoint" }, "user_id":"d10235ef-e177-4c31-a2b7-ea40a80e6824", "id":"08bc431c-0e68-47e7-848d-56ed5ae54952", "created_at":"2020-08-28T11:29:46.987196405Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"d5d7d7aa-43f0-483a-913a-49f3e282b964"}```### Scheduled events#### Scheduled threat scan success```json{ "event":"scheduled_events", "id":"2bfccc7d-0706-4fda-a32f-24016d19dc94", "payload":{ "severity":"INFO", "type":"SCHEDULED_THREAT_SCAN_SUCCESS", "machine_id":"cf406788-edea-4938-b0db-757379d21e11", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "scan_id":"86412100-2b43-4c44-af9e-fb1697b2f019", "schedule_id":"047cb2f2-2bb9-43e7-974e-625c451bf21e", "schedule_name":"Daily Scan", "schedule_command_data":"{\"schedule_for_chromeos\":true,\"schedule_for_mac\":true,\"schedule_for_windows\":true,\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":true},\"mac_scan_settings\":{\"remove\":true,\"pup_detection\":\"Detect\"},\"chromeos_scan_settings\":{}}" }, "id":"f2816da1-5244-4338-a85e-0809da72d77c", "created_at":"2020-08-28T11:29:26.403277042Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf5031f5-e0cb-4bf9-a581-fdf5c6289906"}```#### Scheduled threat scan failure```json{ "event":"scheduled_events", "id":"fac11237-7602-427f-ad6f-c230c138d774", "payload":{ "severity":"WARNING", "type":"SCHEDULED_THREAT_SCAN_FAILURE", "machine_id":"fc2b39dc-d49a-4a62-b1db-f1c9239e4f13", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "scan_id":"00000000-0000-0000-0000-000000000000", "schedule_id":"047cb2f2-2bb9-43e7-974e-625c451bf21e", "schedule_name":"Daily Scan", "schedule_command_data":"{\"schedule_for_chromeos\":true,\"schedule_for_mac\":true,\"schedule_for_windows\":true,\"scan_settings\":{\"type\":\"ThreatScan\",\"remove\":true},\"mac_scan_settings\":{\"remove\":true,\"pup_detection\":\"Detect\"},\"chromeos_scan_settings\":{}}" }, "id":"6f8b5e95-382e-44ef-9621-1921cad7b952", "created_at":"2020-08-28T11:29:52.346309401Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"cf5031f5-e0cb-4bf9-a581-fdf5c6289906"}```### Quarantine events#### Quarantine deleted```json{ "event":"quarantine_events", "id":"38fadc7a-c7e6-4562-a29e-c411cdc2d85e", "payload":{ "severity":"INFO", "type":"QUARANTINE_DELETED", "machine_id":"06667ced-ed77-4cb5-bf17-ab45a6457ec6", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\c8e09e6a-6619-44f3-9b5c-f7a15d258aeb.EXE", "detection_id": "b271af4a-8967-4916-9045-c27cbe1c8f36" }, "id":"1534989f-f720-40d3-b4a8-d2640c8127c4", "created_at":"2020-08-28T11:29:26.992510864Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"3471740f-aaa8-4e2c-8695-2bfb3e378d61"}```#### Quarantine restored```json{ "event":"quarantine_events", "id":"56098088-35ce-44e2-ad1e-1d394580d7b2", "payload":{ "severity":"INFO", "type":"QUARANTINE_RESTORED", "machine_id":"23f22e64-d7d0-4134-9e0a-df2d4372d42f", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\895705b2-4924-4a58-9f57-38bf17190f0e.EXE", "detection_id": "b271af4a-8967-4916-9045-c27cbe1c8f36" }, "id":"851d94de-38f9-4f13-983c-1240e5847bac", "created_at":"2020-08-28T11:30:22.246451515Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"3471740f-aaa8-4e2c-8695-2bfb3e378d61"}```#### Restore quarantine fail```json{ "event":"quarantine_events", "id":"23e86e5f-41ba-4227-9b99-d4d0f6aaf0bb", "payload":{ "severity":"WARNING", "type":"QUARANTINE_RESTORE_FAIL", "machine_id":"f5271fe1-1d4b-462f-97a3-c1c610e6ba80", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\5d2c45f2-a076-4bdb-8cf0-060fa6bb486f.EXE", "detection_id": "b271af4a-8967-4916-9045-c27cbe1c8f36" }, "id":"844d1e23-0e34-4237-bc2d-972758d67a90", "created_at":"2020-08-28T11:30:48.946977118Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"3471740f-aaa8-4e2c-8695-2bfb3e378d61"}```#### Delete quarantine fail```json{ "event":"quarantine_events", "id":"308c0fcf-90e9-4036-a572-82de8aeb5075", "payload":{ "severity":"WARNING", "type":"QUARANTINE_DELETE_FAIL", "machine_id":"4d59b887-34ad-49a2-a103-1ba24dd790f1", "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "machine_name":"NewEndpoint", "details":{ "message":"C:\\\\USERS\\\\ADMIN\\\\DESKTOP\\\\3e7e7a17-969a-4d07-8126-fe62f3b26e82.EXE", "detection_id": "b271af4a-8967-4916-9045-c27cbe1c8f36" }, "id":"eabbd68e-ca6e-4ec9-aa9a-2e448e9983d5", "created_at":"2020-08-28T11:29:55.416828312Z" }, "account_id":"47632e8c-f125-4875-8d5b-ab24275c90a8", "subscription_id":"3471740f-aaa8-4e2c-8695-2bfb3e378d61"}```### Users Events#### User invited```json{ "event": "user_events", "id": "d3f25ec6-e943-495a-b251-f73dca979c1e", "payload": { "severity": "AUDIT", "type": "USER_INVITED", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "id": "d38df30e-5601-40fb-92d1-c6cc55086fce", "created_at": "2021-03-10T12:56:26.316135667Z", "details": { "message": "Email: tifiy10802@566dh.com, Role: Super Admin", "ip_address": "90.191.127.234", "invited_by": "avitella@malwarebytes.com", "invitee_role": "SuperAdmin", "invitee_groupIDs": null, "invitee_email": "tifiy10802@566dh.com", "invitee_allGroupsAccess": true } }, "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id": "f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### User verified```json{ "event": "user_events", "id": "81ca10e2-73fa-4008-b391-f0efe63e3ca5", "payload": { "severity": "AUDIT", "type": "USER_VERIFIED", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "user_id": "a1b739d8-ad84-4730-bb92-252d372ebee4", "id": "878c484f-73d0-4482-8e38-7a8953059074", "created_at": "2021-03-10T12:57:46.961165627Z", "details": { "message": "tifiy10802@566dh.com" } }, "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id": "f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### User role updated```json{ "event": "user_events", "id": "a5696568-490b-44cb-83d3-b97c27b5c272", "payload": { "severity": "AUDIT", "type": "USER_ROLE_UPDATED", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "id": "b6eaceeb-b66a-4f3c-b2d3-1928f959a04d", "created_at": "2021-03-10T12:59:19.612242246Z", "details": { "message": "Changed the role for user test (tifiy10802@566dh.com) from Super Admin to Admin", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "user_email": "avitella@malwarebytes.com", "user_name": "Alessio Vitella" } }, "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id": "f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### User group role updated```json{ "event": "user_events", "id": "700e2e19-7dd5-4dc9-aa75-436bc4ce4449", "payload": { "severity": "AUDIT", "type": "USER_GROUP_ACCESS_UPDATED", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "id": "9e3b48c9-3fee-46dd-807a-3f567205feeb", "created_at": "2021-03-10T12:59:34.6325247Z", "details": { "message": "Group access updated for user test (tifiy10802@566dh.com)", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "user_email": "avitella@malwarebytes.com", "user_name": "Alessio Vitella" } }, "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id": "f43dc73b-2709-4d6f-9c79-08abc815114b"}```#### User deleted```json{ "event": "user_events", "id": "acd4187a-df1e-45bf-8ef7-ef8e666c8ad1", "payload": { "severity": "AUDIT", "type": "USER_DELETED", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "user_id": "c79a9d0b-7fc5-413c-8161-182873f7870f", "id": "f60d1cb0-ed06-4de9-bedd-ea3081df9c0d", "created_at": "2021-03-10T13:01:08.21154784Z", "details": { "message": "tifiy10802@566dh.com was deleted by user avitella@malwarebytes.com", "deleted_by": "avitella@malwarebytes.com", "ip_address": "90.191.127.234" } }, "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "subscription_id": "f43dc73b-2709-4d6f-9c79-08abc815114b"}```### Device control events#### Drive blocked```json{ "event": "drive_events", "id": "60de6386-56d9-4b18-b0dd-8cf75e53665e", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39", "id": "83418205-78d2-453b-b15e-b8ac3e6efc21", "created_at": "2022-02-09T15:36:57.7484112Z", "action": "blocked", "type": "DRIVE_BLOCKED", "details": { "group_id": "39a36fde-49ae-416b-9e68-112d9bfa1945", "group_name": "PMP DNS Lite", "policy_id": "833bd822-e2a6-44e8-a7b6-92ca1edae4c0", "policy_name": "DNS Lite", "metadata": { "timestamp": "2022-02-09T15:36:57.7484112Z", "physical_disk_name": "Walgreen Infinitive USB Device", "pnp_device_id": "USBSTOR\\DISK&VEN_WALGREEN&PROD_INFINITIVE&REV_1.00\\4C530001030323105095&0", "device_id": "\\\\.\\PHYSICALDRIVE1", "disk_interface": "USB", "manufacturer": "Zia Caterina", "serial_number": "4C530001030323105095", "drive_compressed": false, "file_system": "NTFS", "volume_name": "E:", "volume_serial": "44D9870F", "volume_device_path": "\\Device\\HarddiskVolume8", "block_status": "blocked", "driver_metadata": { "DevicePath": "\\DEVICE\\HARDDISKVOLUME8", "FileSystemFlags": 65472255, "FileSystemName": "NTFS", "MaximumComponentLength": 255, "VolumeMountPoints": [ "E:\\" ], "VolumeName": "USB", "VolumePath": "\\\\?\\Volume{0d619cc3-7d50-11ec-9bca-000c2972f401}\\", "VolumeSerialNumber": "1155106575", "schemaVersion": 1 } } }, "machine_name": "pmp-win10x64-00" }, "subscription_id": "f8b2a2f5-1e11-4709-8256-9c17609b05d3"}```### Vulnerability & Patch events#### Vulnerability found```json{ "event": "cve_events", "id": "e2ebad01-faaf-40c7-8b32-00c10ef6dc85", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39", "id": "fb839c2e-ae9a-48c0-9233-ed278ee06b30", "created_at": "2022-05-06T13:49:51.227357Z", "type": "CVE_ADDED", "details": { "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "account_name": "Test Account1", "parent_account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39", "group_id": "39a36fde-49ae-416b-9e68-112d9bfa1945", "root_group_id": "39a36fde-49ae-416b-9e68-112d9bfa1945", "host_name": "TA-Win81x32-001", "fully_qualified_host_name": "TA-Win81x32-001", "display_name": "TA-Win81x32-001", "vendor": "Adobe Systems Inc.", "normalized_vendor": "adobe", "product": "Adobe Flash Player", "installed_version": "32.0.0.207", "created_at": "2022-05-06T13:49:49.893680453Z", "os_info": { "os_type": "Workstation", "os_version": "6.3.9600", "os_platform": "Windows", "os_architecture": "x86", "os_release_name": "Microsoft Windows 8.1 Enterprise" }, "sort_id": 1651844991145, "cve_id": "CVE-2019-8075", "cisa_exploitable": true, "severity": "medium", "severity_score": 58, "published_at": "2019-09-27T16:15:00Z", "cvss30_score": 7.5, "cvss20_score": 5, "description": "Adobe Flash Player version 32.0.0.192 and earlier versions have a Same OriginPolicy Bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.", "resolution": { "text": "Product is defunct, please uninstall it." }, "document_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39c6ba419679d8950eabad5c0385703f78CVE-2019-8075", "display_vendor": "adobe", "display_product": "Adobe Flash Player", "display_installed_version": "32.0.0.207", "version": 0 } }, "subscription_id": "f8b2a2f5-1e11-4709-8256-9c17609b05d3"}```#### Patch available```json{ "event": "cve_events", "id": "dea7139e-5589-4d7a-b30c-3b8ed827c4fa", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39", "id": "9a608078-7192-4a68-bfce-ec35121a79f1", "created_at": "2022-05-06T13:49:51.22989Z", "type": "CVE_PATCH_AVAILABLE", "details": { "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "account_name": "Test Account1", "parent_account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "9278ff33-9989-47d1-ac1f-fc40381f3b39", "group_id": "39a36fde-49ae-416b-9e68-112d9bfa1945", "root_group_id": "39a36fde-49ae-416b-9e68-112d9bfa1945", "host_name": "TA-Win81x32-001", "fully_qualified_host_name": "TA-Win81x32-001", "display_name": "TA-Win81x32-001", "created_at": "2022-05-06T13:49:49.893680453Z", "sort_id": 1651844991166, "os_info": { "os_type": "Workstation", "os_version": "6.3.9600", "os_platform": "Windows", "os_architecture": "x86", "os_release_name": "Microsoft Windows 8.1 Enterprise" }, "title": "Microsoft .NET Framework 4.8 for Windows 8.1 (KB4486105)", "description": "The Microsoft .NET Framework 4.8 is a highly compatible, in-place update forall the previous versions of .NET Framework 4.X. After you install this update, you may have to restart your computer.", "product": "Windows 8.1", "severity": "important", "category": "feature_pack", "security_update_id": "", "patch_id": "4486105", "released_at": "2020-01-14T05:00:00Z", "size": 44044135, "reboot_required": true, "document_id": "9278ff33-9989-47d1-ac1f-fc40381f3b394486105", "version": 0 } }, "subscription_id": "f8b2a2f5-1e11-4709-8256-9c17609b05d3"}```#### Software updated```json{ "event": "cve_events", "id": "5168387e-41a7-47cd-b554-f5d49308c464", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "payload": { "severity": "INFO", "machine_name": "Avarosa", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "machine_id": "07386bfa-d493-41b3-bff1-db6dfe64e17f", "action": "COMPLETED", // enum: ["FAILED","COMPLETED"] "details": { "application_name": "Microsoft Visual C++ Redistributable 2013", "current_version": "12.0.30501.0", "new_version": "12.0.40664.0", "product": 3092, "vendor": "microsoft" }, "created_at": "2022-05-09T10:39:59.14429501Z", "id": "1f79149f-d38f-4c20-a09e-75f2debf812a", "type": "CVE_SOFTWARE_UPDATED" }, "subscription_id": "a469cd25-4c0b-4e35-98cd-b2a01f09945d"}```#### Patch applied```json{ "event": "cve_events", "id": "ff0edfda-6cae-4adc-9b4b-1b5f23002d4d", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "payload": { "severity": "INFO", "machine_name": "Avarosa", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "machine_id": "07386bfa-d493-41b3-bff1-db6dfe64e17f", "action": "COMPLETED", // enum: ["FAILED","COMPLETED","REBOOT_REQUIRED"] "details": { "category": "critical_update", "product": ".NET Core 3.1", "severity": "important", "title": "2021-10 .NET Core 3.1.20 Update for Windows 11 for x64 Client (KB5007050)", "vendor": "Armut Corp", "reboot_required": false, "description": "2021-10 .NET Core 3.1.20 Update for Windows 11 for x64 Client (KB5007050)", "date": 1634277600, "size": 189019608, "kb_id": "5007050", "security_update_id": "" }, "created_at": "2022-05-09T10:40:31.848869068Z", "type": "CVE_PATCH_APPLIED" }, "subscription_id": "a469cd25-4c0b-4e35-98cd-b2a01f09945d"}```### DNS Content Filtering events#### DNS blocked```json{ "event": "dns_events", "id": "4974972d-36f6-4c0f-a687-626d33a98609", "account_id": "f9c1e231-891e-40a2-93a8-7666a527c67d", "payload": { "severity": "INFO", "account_id": "f9c1e231-891e-40a2-93a8-7666a527c67d", "machine_id": "675c4b7a-335b-47c1-b71f-868f03ccf263", "created_at": "2022-09-01T15:32:12.706971938Z", "id": "0dcdf1c6-16fc-4bb7-b94f-ba1db2d5d4fb", "details": { "id": "bef4894f-d4e7-4cee-b52e-f15998c6ab49", "machine_id": "675c4b7a-335b-47c1-b71f-868f03ccf263", "group_id": "faafbf27-e166-45ce-bb16-f01f3a5b7ae1", "group_name": "Default Group", "account_id": "f9c1e231-891e-40a2-93a8-7666a527c67d", "parent_account_id": "f9c1e231-891e-40a2-93a8-7666a527c67d", "policy_id": "fa4331e7-989b-47b3-8f40-efff592d573c", "rule_id": "d25c4ec1-bb72-4d5a-8f4b-20cd131634d6", "rule_name": "no msnbc", "policy_name": "Default Policy", "action": "block", "log": { "colo_id": 465, "datetime": "2022-09-01T15:31:45Z", "device_id": "5f166267-2a09-11ed-99f4-7a63bd6fb789", "user_id": "721ab000-8a6c-4b54-858c-1b67f6d4a630", "dst_ip": "162.159.36.5", "src_ip": "98.207.10.35", "email": "non_identity@mwb-nebula-7bde22be1cb528441ad14380f02a8411.cloudflareaccess.com", "location": "d25c4ec1-bb72-4d5a-8f4b-20cd131634d6", "policy": "", "policy_id": "ccb7fe0d52fb493dbfdc2cf4de0764ee", "protocol": "https", "query_name": "msnbc.com", "query_name_reversed": "com.msnbc", "resolver_decision": "blockedRule", "query_category_ids": [7,122,164], "query_size": 38, "query_type": 28, "src_port": 0, "dst_port": 0 }, "document_id": "bef4894f-d4e7-4cee-b52e-f15998c6ab49", "version": 0, "@timestamp": "2022-09-01T15:32:12.706971938Z" }, "type": "DNS_BLOCKED" }, "subscription_id": "f01dc32c-76a6-4629-8efa-5afe861f32b7"}```### License events#### License Entitlement Added```json{ "event": "license_events", "id": "5db19165-9078-408d-be55-38b540fb8527", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_ENTITLEMENT_CHANGED", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "id": "1e659a56-5b03-493a-baf8-bb3ecd628c59", "details": { "id": "5944a421-9f33-4471-9382-72525fae1427", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBDNS-B,NCCA-B", "catalog_code": "", "combo_product": "NEBULA-DNS-COMBO", "licensed_seats": 10, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "licensed_remediations": 0, "licensed_remediation_factor": 0, "remediation_count": 0, "created_at": "2022-11-17T14:01:07.426394557Z", "updated_at": "2022-11-17T14:01:07.426394557Z", "active": true, "machine_counts": null, "auto_renew": "no", "can_be_paid": false, "keystone_id": 35093303 }, "action": "added", "created_at": "2022-11-17T14:01:07.556054636Z" }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```#### License Entitlement Updated```json{ "event": "license_events", "id": "599e8be4-ae4b-4066-b31c-ea223e900179", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_ENTITLEMENT_CHANGED", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "id": "a13fdaca-13a1-4e4e-88f8-ac66309ef11b", "details": { "old_entitlement": { "id": "5944a421-9f33-4471-9382-72525fae1427", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBDNS-B,NCCA-B", "catalog_code": "", "combo_product": "NEBULA-DNS-COMBO", "licensed_seats": 10, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "licensed_remediations": 0, "licensed_remediation_factor": 0, "remediation_count": 0, "created_at": "2022-11-17T14:01:07.426395Z", "updated_at": "2022-11-17T14:01:07.426395Z", "active": true, "machine_counts": null, "auto_renew": "no", "can_be_paid": false, "keystone_id": 35093303 }, "new_entitlement": { "id": "5944a421-9f33-4471-9382-72525fae1427", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBDNS-B,NCCA-B", "catalog_code": "", "combo_product": "NEBULA-DNS-COMBO", "licensed_seats": 20, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "licensed_remediations": 0, "licensed_remediation_factor": 0, "remediation_count": 0, "created_at": "0001-01-01T00:00:00Z", "active": true, "machine_counts": null, "auto_renew": "no", "can_be_paid": false, "keystone_id": 35093303 } }, "action": "updated", "created_at": "2022-11-17T14:02:38.006653379Z" }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```#### License Entitlement Removed```json{ "event": "license_events", "id": "29d6f063-fd95-4b6a-bcdb-1ecaaa15eb87", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_ENTITLEMENT_CHANGED", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "id": "038304ca-4fa8-4926-a3d6-fca29c6b1e71", "details": { "id": "5944a421-9f33-4471-9382-72525fae1427", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBDNS-B,NCCA-B", "catalog_code": "", "combo_product": "NEBULA-DNS-COMBO", "licensed_seats": 20, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "licensed_remediations": 0, "licensed_remediation_factor": 0, "remediation_count": 0, "created_at": "2022-11-17T14:01:07.426395Z", "updated_at": "2022-11-17T14:02:37.95501Z", "active": true, "machine_counts": null, "auto_renew": "no", "can_be_paid": false, "keystone_id": 35093303 }, "action": "removed", "created_at": "2022-11-17T14:03:06.077892882Z" }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```#### License Entitlement Usage changed```json{ "event": "license_events", "id": "a79b4fbb-90f2-408c-a3d5-e4b37cdaa9d1", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_ENTITLEMENT_USAGE_CHANGED", "created_at": "2022-11-17T15:57:59.921931957Z", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "details": { "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B", "catalog_code": "BUS-CLOUD-EPP-01", "combo_product": "NEBULA-EP-COMBO", "licensed_seats": 10, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "auto_renew": "no", "used_seats": 5 } }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```#### License Over deployment```json{ "event": "license_events", "id": "c39ce0df-ed3d-4f31-bea4-b2926b36f49a", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_OVER_DEPLOYMENT", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "details": { "message": "Over deployment", "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B", "catalog_code": "BUS-CLOUD-EPP-01", "combo_product": "NEBULA-EP-COMBO", "licensed_seats": 3, "license_expires_at": "2023-11-17T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "auto_renew": "no", "used_seats": 4 }, "created_at": "2022-11-17T14:49:59.333193431Z" }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```#### License Expiring```json{ "event": "license_events", "id": "533605a0-6cce-4b9a-8292-101f0b9583c2", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "payload": { "severity": "INFO", "type": "LICENSE_EXPIRING", "account_id": "00017df6-13c5-4cac-8967-40f85b054e4e", "details": { "license_key": "CBFCK-XRRG2-67ZDJ-CGHUS", "licensed_product": "MBAE-B,MBAM-B,MBBR-B,MBCM-B,MBFT-B,MBRX-B,NCCA-B,NCEP-B,NCRM-B", "catalog_code": "BUS-CLOUD-EPP-01", "combo_product": "NEBULA-EP-COMBO", "licensed_seats": 3, "license_expires_at": "2022-11-30T23:59:59Z", "license_key_status": "active", "license_term_type": "subscription", "license_status": "active", "auto_renew": "no", "used_seats": 4, "message": "Expiring license", "days_left": 14 // enum: [0, 1, 7, 14 ,30] }, "created_at": "2022-11-17T14:56:26.743834259Z" }, "subscription_id": "1fa8e9ee-7a16-4197-987f-4362ddfbd5ac"}```### Application Block events#### Application blocked```json{ "event": "appblock_events", "id": "b3e1f103-c490-445f-9136-d45450e1a961", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "payload": { "type": "APPBLOCK_BLOCKED", "document_id": "e8c540c7-fe43-511d-b6df-805656440afd", "severity": "INFO", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "machine_id": "f2750e61-a41c-47ed-8d12-fca857fe8453", "group_id": "f4b15520-3153-4956-be41-185c4a523cfc", "action": "blocked", "id": "e8c540c7-fe43-511d-b6df-805656440afd", "created_at": "2023-03-15T13:34:02.80344Z", "root_group_id": "f4b15520-3153-4956-be41-185c4a523cfc", "account_name": "Test-Account3", "parent_account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "group_name": "Default Group", "policy_id": "4ab40443-dea1-4c76-8713-ef5141307b98", "policy_name": "!!!!_!_!!!_!!_!_!NEW POLICY12345", "details": { "file_path": "C:\\burla2.exe", "matching_rule_ids": [ "33741ecc-6775-4f13-b7d9-4f462a59fc2a" ], "app_block_rules": [ { "id": "33741ecc-6775-4f13-b7d9-4f462a59fc2a", "account_id": "550a20b8-6d36-4222-afbc-54d100f2e894", "name": "Rule test 34", "rule": { "action": "block", "files": [ "C:\\burla2.exe" ] }, "type": "files" } ], "group_id": "f4b15520-3153-4956-be41-185c4a523cfc", "group_name": "Default Group", "policy_id": "4ab40443-dea1-4c76-8713-ef5141307b98", "policy_name": "!!!!_!_!!!_!!_!_!NEW POLICY12345", "last_user": "ben-fake-endpoint\\Testuser" } }, "subscription_id": "a22a2b59-4897-45de-b055-cfa1eabb9d1e"}```### Endpoint status events#### Endpoint reboot required```json{ "event": "endpoint_events", "id": "a8f76811-fa21-48b3-8bba-6b6e800ecc6e", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_REBOOT_REQUIRED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:06:02.410951Z", "id": "3e52d13e-ac67-109b-b0a9-9443f785f5d1", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-3168-45c4-89fb-378d59031d12"}```#### Endpoint reboot cleared```json{ "event": "endpoint_events", "id": "a8f76811-fa21-48b3-6bba-1b6e800ecc6e", "account_id": "f29c5663-10a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_REBOOT_REQUIRED_CLEARED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:06:02.410951Z", "id": "3e52d13e-ac67-409b-b0a9-9443f785f5d1", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-55c4-89fb-378d59031d12"}```#### Endpoint remediation requiredThis event is emitted when at least one detection is detected while the endpoint had no detection before```json{ "event": "endpoint_events", "id": "f98f4ee7-1a32-4840-8d5d-9d4ab0adac93", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_INFECTED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288002d-806e-4b2b-a0d4-f8f80ae801e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```#### Endpoint remediatedThis event is emitted when all the detections are remediated for an endpoint```json{ "event": "endpoint_events", "id": "f98f4ee7-1232-4840-8d5d-9ddab0adac93", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_REMEDIATED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288040d-806e-4b2b-a0d4-f8f80ae801e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```#### Endpoint isolated```json{ "event": "endpoint_events", "id": "f98f4ee7-1a32-4840-8d5d-9ddab0adac95", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_ISOLATED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288000d-806e-4b2b-a0d4-f8f80ae831e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```#### Endpoint un-isolated```json{ "event": "endpoint_events", "id": "f98f4ee7-1a32-4840-8d5d-9ddab0adac93", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_UNISOLATED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288000d-806e-4b2b-a0d4-f8f80ae801e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```#### Suspicious activity detectedThis event is emitted when at least one suspicious activity is detected while the endpoint had no suspicious activities before```json{ "event": "endpoint_events", "id": "f98f4ee7-1a32-4840-8d5d-9ddab0ad3c93", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_SUSPICIOUS_ACTIVITY_FOUND", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288000d-806e-2b2b-a0d4-f8f80ae801e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```#### Suspicious activity clearedThis event is emitted when all the suspicious activities are cleared for an endpoint```json{ "event": "endpoint_events", "id": "f98f4ee7-1a32-4840-8d5d-9ddab0ad3c93", "account_id": "f29c5663-180a-4cd5-a5c3-b9a45e67ad21", "payload": { "severity": "INFO", "type": "ENDPOINT_SUSPICIOUS_ACTIVITY_CLEARED", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-17T15:52:42.6652Z", "id": "d288200d-806e-2b2b-a0d4-f8f80ae801e8", "machine_name": "test_machine387" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```### Agent Events#### Endpoint needs attentionThis event is emitted when the list of alerts form the endpoint is changed```json{ "event": "agent_events", "id": "3be75bf1-0926-41b5-9c6f-ad4a70123293", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "payload": { "type": "AGENT_ALERTS_CHANGED", "severity": "INFO", "account_id": "f29c5663-100a-4cd5-a5c3-b9a45e67ad21", "machine_id": "350eff78-1061-4357-b992-3121d22288ab", "created_at": "2023-01-18T10:59:40.3162Z", "id": "4ec6595c-e8c4-4a85-b1e1-2ceff1086c59", "details": { "added_codes": ["FULL_DISK_ACCESS_DISABLED"], "cleared_codes": [], "current_codes": ["FULL_DISK_ACCESS_DISABLED"] }, "machine_name": "dummy-host.corp.mb-test.com" }, "subscription_id": "289ffcf2-1168-45c4-89fb-378d59031d12"}```