Incident API

Get incidents within a specific timeframe

Retrieves incidents generated within a specified period of time.

GET

https://Logpoint-IP/incidents

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — a JSON object containing:
- ts_from: Start timestamp value in Unix time format.
- ts_to: End timestamp value in Unix time format.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "ts_from": 1633085529,
        "ts_to": 1640595047
    }
}

Request Example

cURL

curl --location --request GET 'https://10.45.10.172/incidents' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "ts_from": 1633085529,
        "ts_to": 1640595047
    }
}'

Sample JSON Response

{
    "success": true,
    "incidents": [incident1, incident2, …, incidentN]
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

incidents

Array of objects

Contains a list of incidents generated within the specified time period. Each object represents an individual incident.

Sample Incident

{
    "type": "Alert",
    "alert_obj_id": "61b1cce5c472652e64a27cc5",
    "alertrule_id": "02df0d1b985ba3af48fdc4287c560d11",
    "incident_id": "52985081d974e636c930d7c604734705",
    "name": "Average severity per device alert",
    "description": "Fires an alert if the average severity per device is more than a certain threshold",
    "username": "5bebd9fdd8aaa42840edc853",
    "assigned_to": "5bebd9fdd8aaa42840edc853",
    "rows_count": 100,
    "risk_level": "medium",
    "detection_timestamp": 1640599338.5200958,
    "loginspect_ip_dns": "101.45.45.45",
    "Logpoint_name": "Logpoint",
    "status": "unresolved",
    "comments": [],
    "commentscount": 0,
    "query": "action=*",
    "repos": ["127.0.0.1:5504"],
    "time_range": [1640595600, 1640599200],
    "throttle_enabled": false,
    "attack_id": ["T1592", "T1608", "T1078", "T1003.002", "T1001"],
    "attack_tag": ["Gather Victim Host Information", "Stage Capabilities", "Valid Accounts", "Security Account Manager", "Data Obfuscation"],
    "attack_category": ["Initial Access", "Privilege Escalation", "Credential Access", "Resource Development", "Reconnaissance", "Defense Evasion", "Persistence", "Command and Control"],
    "metadata": [],
    "log_source": ["Firewall", "Fortigate"],
    "notifications": [
        {
            "dispatch_option": "manual",
            "email_emails": ["[email protected]"],
            "email_template": "<pre ...>...</pre>",
            "link_disable": false,
            "logo_enable": true,
            "logo_type": "default",
            "notify_email": true,
            "raw_emails": ["[email protected]"],
            "subject": "Test",
            "template_file": "alert_5bebd9fdd8aaa42840edc853_b'IF3GK4TBM...'.tmp",
            "type": "email"
        }
    ],
    "id": "61c98f2af2adef60601f5a86"
}

Filtering incident data

You can retrieve additional data about incidents using optional parameters inserted in the endpoint URL as a query string.

Parameter

Value Type

Description

name

String

Identification parameters: Name: Name of the incidents.

Incident ID: Unique identifier of the incidents.

AlertRule ID: Unique identifier of the alert rule that generates the incidents.

status

String

incident status: closed, resolved, unresolved

type

String

Source of the incident: alert, search, ueba

risk

String

Severity level: critical, high, medium, low

attack_category

String

Attack category

attack_tag

String

Attack tag

log_source

String

Incident Log source

Metadata fields

String

User-defined parameter associated with the Metadata field of Alert or Incident Categorization

Sample Queries

The only supported method to include multiple query parameters in the query string is by using an ampersand (&). Use comma (,) to send multiple values in a single parameter.

https://Logpoint-IP/incidents?name=Windows Registry Value Change&risk=critical&risk=high&type=alert&status=unresolved

The above query filters the incidents named Windows Registry Value Change generated from alert having critical and high severity level and are in unresolved state.

https://Logpoint-IP/incidents?attack_category=Command and Control,Collection&attack_tag=Protocol Impersonation&log_source=Webserver&System=Microsoft Windows

The above query filters the incidents whose attack categories are Command and Control and Collection, attack tag is Protocol Impersonation, log source value is Webserver, and System value is Microsoft Windows. Here System is the custom metadata field provided by the user while categorizing the alert or incident.

Get the data for a single incident

Retrieves data for a single incident.

GET

https://Logpoint-IP/get_data_from_incident

Request Parameters

Included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- incident_obj_id: Value of the id of the particular incident.
- incident_id: Value of the field incident_id of the particular incident.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "incident_obj_id": "6156e859b92e73ec9b0b9bfa",
        "incident_id": "a84eba14a93482092a1db865c87516af"
    }
}

Request Example

cURL

curl --location --request GET 'https://10.45.10.172/get_data_from_incident' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "incident_obj_id": "6156e859b92e73ec9b0b9bfa",
        "incident_id": "a84eba14a93482092a1db865c87516af"
    }
}'

Sample JSON Response

{
    "success": True,
    "rows": [row1, row2, …, rowN]
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

rows

Array of objects

A list of log rows or data entries related to the single incident, with each object representing one row.

Sample Rows

{
    "msg": "2021-10-01 10:49:56 Logpoint INFO: dashboard; initialized; type=audit_log; user='admin'; source_address='10.94.128.85'",
    "type": "audit_log",
    "log_ts": 1633085396,
    "_type_str": "msg col_type device_name collected_at device_ip ...",
    "device_name": "localhost",
    "_offset": 247101,
    "Logpoint_name": "Logpoint",
    "source_address": "10.94.128.85",
    "host": "Logpoint",
    "action": "initialized",
    "repo_name": "_Logpoint",
    "source_name": "/opt/immune/var/log/audit/webserver.log",
    "col_ts": 1633085404,
    "_tz": "UTC",
    "log_level": "INFO",
    "user": "admin",
    "object": "dashboard",
    "device_ip": "127.0.0.1",
    "_labels": ["Audit", "Logpoint", "KB", "Dashboard"]
},
{
    "terminal_type": "unknown",
    "msg": "Oct  1 10:49:41 Logpoint sudo: loginspect : TTY=unknown ; PWD=/opt/makalu/installed/webserver ; USER=root ; COMMAND=/opt/immune/installed/system/root_actions/fwrunner.py -l warning -c /opt/immune/etc/config/0_boot_firewall/config.yaml",
    "log_ts": 1633085394,
    "caller_user": "loginspect",
    "path": "/opt/makalu/installed/webserver",
    "_type_str": "msg col_type device_name collected_at device_ip ...",
    "device_name": "localhost",
    "Logpoint_name": "Logpoint",
    "host": "Logpoint",
    "repo_name": "_Logpoint",
    "source_name": "/var/log/auth.log",
    "col_ts": 1633085394,
    "process": "sudo",
    "_tz": "UTC",
    "norm_id": "Logpoint",
    "command": "/opt/immune/installed/system/root_actions/fwrunner.py -l warning -c /opt/immune/etc/config/0_boot_firewall/config.yaml",
    "user": "root",
    "_labels": ["Issue", "Execute", "Command", "Logpoint"]
}

Get incident states

Retrieves the status of incidents modified within a specific time period.

GET

https://Logpoint-IP/incident_states

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- ts_from: Start timestamp in Unix time format.
- ts_to: End timestamp in Unix time format.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "ts_from": 1633085529,
        "ts_to": 1640595047
    }
}

Request Example

cURL

curl --location --request GET 'https://10.45.10.172/incident_states' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "ts_from": 1633085529,
        "ts_to": 1683624378
    }
}'

Sample JSON Response

{
    "success": true,
    "incidents": [state1, state2, …, stateN]
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

incidents

Array of objects

A list of incidents with a status, modified within the specified time period.

Example Response

{
    "id": "61c97d96f2adef60601f5a66",
    "name": "test",
    "assigned_to": "5bebd9fdd8aaa42840edc853",
    "status": "resolved",
    "comments": [
        {"title": "admin", "comment": "Resolved", "time": 1640594922},
        {"title": "admin", "comment": "Verified and Necessary Action applied", "time": 1640594947},
        {"title": "admin", "comment": "Completed", "time": 1640595047}
    ]
}

Add Comments to Incident

Add comments to an incident.

POST

https://Logpoint-IP/add_incident_comment

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- _ids: Object ID of the particular incident.
- comments: The comment(s) to add to the incident.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "states": [
            {
                "_id": "6156e859b92e73ec9b0b9bfa",
                "comments": ["Comment1", "Comment2"]
            },
            {
                "_id": "6156e985b92e73ec9b0b9bfb",
                "comments": ["Comment1", "Comment2"]
            }
        ]
    }
}

Request Example

cURL

curl --location 'https://10.45.10.172/add_incident_comment' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "states": [
            {
                "_id": "6156e859b92e73ec9b0b9bfa",
                "comments": ["Test Comment"]
            }
        ]
    }
}'

Sample JSON Response

{
    "success": true,
    "message": "Comments added"
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

message

String

Confirmation that comment is added.

Assign or re-assign incident

To assign or re-assign an incident.

POST

https://Logpoint-IP/assign_incident

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- incident_ids: List of all incident IDs.
- new_assignee: ID of the user to assign to the incident.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ],
        "new_assignee": "59b0eecfd8aaa4334ee41707"
    }
}

Request Example

cURL

curl --location 'https://10.45.10.172/assign_incident' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ],
        "new_assignee": "59b0eecfd8aaa4334ee41707"
    }
}'

Sample JSON Response

{
    "success": true,
    "message": "Incidents re-assigned"
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

message

String

Confirmation message incident reassigned.

Resolve Incidents

Resolve incidents by identifying them using their incident id.

POST

https://Logpoint-IP/resolve_incident

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- incident_ids: List of all incident IDs.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}

Request Example

cURL

curl --location 'https://10.45.10.172/resolve_incident' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}'

Sample JSON Response

{
    "success": true,
    "message": "Incidents resolved"
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

message

String

Confirmation of resolved incident.

Close Incidents

POST

https://Logpoint-IP/close_incident

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- incident_ids: All incidents to close based on their IDs.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}

Request Example

cURL

curl --location 'https://10.45.10.172/close_incident' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}'

Sample JSON Response

{
    "success": true,
    "message": "Incidents closed"
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

message

String

Confirmation incident is closed.

Reopening Incidents

Reopens incidents using incident IDs.

POST

https://Logpoint-IP/reopen_incident

Request Parameters

Should be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
requestData — JSON object containing:
- incident_ids: All incidents to re-open based on their IDs.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}

Request Example

cURL

curl --location 'https://10.45.10.172/reopen_incident' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1",
    "requestData": {
        "version": "0.1",
        "incident_ids": [
            "5a62bd8cce983de89085429c",
            "5a62bd8cce983de89085429b",
            "5a62bd8cce983de89085429e"
        ]
    }
}'

Sample JSON Response

{
    "success": true,
    "message": "Incidents reopened"
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

message

String

Confirmation incidents are re-opened.

Getting Incident Users and User Groups

To retrieve user information.

GET

https://Logpoint-IP/get_users

Request Parameters

Must be included in the request body as raw text.
Content-Type, Content-Length, and Host must be in the request header.
Content-Type should be application/json.
username = Name of the incident user.
secret_key = Key that authorizes user.

{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1"
}

Request Example

cURL

curl --location --request GET 'https://10.45.10.172/get_users' \
--header 'Content-Type: application/json' \
--data '{
    "username": "John",
    "secret_key": "a1b2c3d4e5f6g7h8i9j0k1"
}'

Sample JSON Response

{
  "success": true,
  "users": [
    {
      "usergroups": [
        {"id": "5bebd9fdd8aaa42840edc84f", "name": "Logpoint Administrator"}
      ],
      "id": "5bebd9fdd8aaa42840edc853",
      "name": "admin"
    },
    {
      "usergroups": [
        {"id": "5bebd9fdd8aaa42840edc84f", "name": "Logpoint Administrator"}
      ],
      "id": "5e15969ff5f33401e60fe757",
      "name": "sample admin"
    },
    {
      "usergroups": [
        {"id": "5bebd9fdd8aaa42840edc850", "name": "User Account Administrator"}
      ],
      "id": "5e1bef95f5f33436dd3a9f07",
      "name": "sample user"
    }
  ]
}

Response Parameters

Value Type

Description

success

Boolean

True if successful; False if unsuccessful

users

Array of objects

List of user details and associated user groups.

usergroups

Array of objects

List of user group objects where the user belongs.

incident_ids

String

Unique identifier of user and user groups.

name

String

Name of user and user groups.

Last updated 14 days ago

Was this helpful?

Good night

hashtagGet incidents within a specific timeframe

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagSample Incident

hashtagFiltering incident data

hashtagSample Queries

hashtagGet the data for a single incident

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagSample Rows

hashtagGet incident states

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagExample Response

hashtagAdd Comments to Incident

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagAssign or re-assign incident

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagResolve Incidents

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagClose Incidents

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagReopening Incidents

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

hashtagGetting Incident Users and User Groups

hashtagRequest Parameters

hashtagRequest Example

hashtagcURL

hashtagSample JSON Response

hashtagResponse Parameters

Get incidents within a specific timeframe

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Sample Incident

Filtering incident data

Sample Queries

Get the data for a single incident

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Sample Rows

Get incident states

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Example Response

Add Comments to Incident

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Assign or re-assign incident

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Resolve Incidents

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Close Incidents

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Reopening Incidents

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters

Getting Incident Users and User Groups

Request Parameters

Request Example

cURL

Sample JSON Response

Response Parameters