Get - Neuron Agent API

Overview

Allows the client to get open intelligence based on input search parameters. You can search on endpoint, vector, protocol, classification, code or time interval. You can leave input fields empty. Only fields with non-empty values will restrict the result set in the search. Use the offset and max count arguments to implement pagination.

HTTP request

POST /Agent/Intelligence/Get

Authentication

Requires a valid JWT bearer token.

Request (JSON)

{
	"endpoint": Optional(Str(PEndpoint)),
	"vector": Optional(Str(PVector)),
	"protocol": Optional(Str(PProtocol)),
	"classification": Optional(Str(PClassification)),
	"code": Optional(Str(PCode)),
	"from": Optional(DateTime(PFrom)),
	"to": Optional(DateTime(PTo)),
	"offset": Optional(Integer(POffset >= 0)),
	"maxCount": Optional(Integer(0 < PMaxCount <= 100))
}

Input parameters

Parameter	Description
PEndpoint	Restrict search to this endpoint.
PVector	Restrict search to this vector.
PProtocol	Restrict search to this protocol.
PClassification	Restrict search to this classification.
PCode	Restrict search to this code.
PFrom	Restrict search to information generated after this point in time (inclusive).
PTo	Restrict search to information generated before this point in time (inclusive).
POffset	Ignore the first POffset number of information records.
PMaxCount	Maximum number of records to return.

Response (JSON)

{
	"ResultSet": Optional(
		{
			"objectId": Required(Str(PObjectId)),
			"domain": Optional(Str(PDomain)),
			"endpoint": Required(Str(PEndpoint)),
			"timestamp": Required(DateTimeUtc(PTimestamp)),
			"expires": Required(DateTimeUtc(PExpires)),
			"vector": Optional(Str(PVector)),
			"protocol": Optional(Str(PProtocol)),
			"classification": Optional(Str(PClassification)),
			"code": Optional(Str(PCode)),
			"message": Optional(Str(PMessage)),
			"Tags": Optional(
			{
				"name": Required(Str(PTagName)),
				"value": Optional(PTagValue),
				"type": Optional(Str(PTagType))
			}
			[]),
			"AgentInformation": Optional(
			{
				"name": Required(Str(PAgentPropertyName)),
				"value": Optional(Str(PAgentPropertyValue))
			}
			[])
		}
		[])
}

Response parameters

Parameter	Description
PObjectId	Object ID of information record.
PEndpoint	Endpoint to which information relates.
PTimestamp	When information was recorded.
PExpires	When information expires.
PVector	Information about threat vector.
PProtocol	Information about communication protocol protocol.
PClassification	Information about classification.
PCode	Information about code.
PMessage	Information message.
PTagName	Name of information meta-data tag.
PTagValue	Value of information meta-data tag.
PTagType	Type of information meta-data tag.
PAgentPropertyName	Name of property of agent recording the information.
PAgentPropertyValue	Value of property of agent recording the information.

Notes

This endpoint uses the request schema notation described in Pattern matching.

​Overview

​HTTP request

​Authentication

​Request (JSON)

​Input parameters

​Response (JSON)

​Response parameters

​Notes