Search Event‎

POST /Command/SearchEvent

Search events based on the given search criteria

Request

Authentication: API keys or JSON web tokens (JWT)

Body Parameters

Parameter Name	Type	Required/Optional	Description
Username	`string`	Required	The username of your D3 SOAR account.
Site	`string`	Required	The D3 SOAR site to run the remote command.
Time Range	`JSON Object`	Optional	Set the Time Range to fetch. "timeRangeType": 0 - Custom range, 1 - Past hour, 2 - Past 24 hours, 3 - Past week, 4 - Past month
Top Recent Event Number	`integer`	Optional	Set the number of the most recent Event(s) to fetch
Constraint Condition	`array<JSON Object>`	Optional	Conditions for filtering events

Body Sample Data

application/json

JSON

{
  "Username": "Admin",
  "Site": "Security Operations",
  "CommandParams": {
    "Time Range": {
      "timeRangeType": 4,
      "startTime": "2020-06-04 23:02:11",
      "endTime": "2020-07-04 23:02:11"
    },
    "Top Recent Event Number": 20,
    "Constraint Condition": "[Configured in Playbook Command Task Editor]"
  }
}

Response

200 OK

application/json

Response Fields

Field Name	Type	Description
error	`string`	The error message if the API request has failed.
returnData	`JSON Object`	The return data from the API request.

Sample Data

JSON

{
    "error": "",
    "returnData": {
        "EventIDs": [
            60098,
            60097,
            60096
        ]
    }
}

400 BadRequest

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The body of the request must be a valid JSON object"}

401 Unauthorized

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Invalid authentication key."}

429 TooManyRequests

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "The request exceeds rate limits or is otherwise blocked by rate limiting policies."}

500 InternalServerError

application/json

Response Fields

Field Name	Type	Description
Error	`string`	A error message when the API request fails.

Sample Data

JSON

{"Error": "Unexpected Error."}