REST API Detections
List of detections
HTTP request:
GET api/v1/detections |
URL query:
Pagination:
$top |
Requests to include the number of items in the queried collection. |
$skip |
Requests to skip and not include the number of items in the queried collection. |
$count |
Enables clients to request a count of the matching resources included with the resources in the response. If set to $count=1, the number of detections is returned. |
Sorting:
$orderBy |
Enables clients to request resources in ascending order using $orderBy=asc or descending order using $orderBy=desc. The default order is ascending. |
Filtering:
$filter |
Enables clients to filter resources addressed by a request URL. The query supports the following operators eq, ne, gt, ge, lt, le, and, or, and (). Operators can combine with values to filter data. For instance, resolved eq 0 will report only unresolved detections. |
Example:
|
GET api/v1/detections?$skip=100&$orderBy=creationTime desc |
For other examples, follow System Query Options
Request header: Authorization token
Request body: None
Response: JSON object with the following properties:
Value |
Description |
|---|---|
computerId |
A computer's unique identifier in the ESET Inspect Database |
computerName |
The computer's name that raised the detection |
computerUuid |
A computer's unique identifier in the ESET Inspect Database |
creationTime |
Time of the detection |
id |
Unique detection identifier in the ESET Inspect Database |
moduleId |
Unique executable identifier in the ESET Inspect Database |
moduleLgAge |
Number of days visible in the LiveGrid® |
moduleLgPopularity |
How many computers reported an executable to LiveGrid® |
moduleLgReputation |
A number from 1 to 9, indicating how safe the file is: 1–2 (red) is malicious, 3–7 (yellow) is suspicious, 8–9 (green) is safe |
moduleName |
The executable that triggered the detection |
moduleSha1 |
The executable's hash that triggered the detection |
moduleSignatureType |
Information on if and how the file is signed. Based on its return value: 90 = Trusted 80 = Valid 75 = AdHoc 70 = None 60= Invalid |
moduleSigner |
The file signer's name, if available |
note |
Shows a note |
priority |
The detection's priority (default 0, otherwise set by ESET Inspect Administrator) |
processCommandLine |
Shows the argument used with the command |
processId |
Unique process identifier in the ESET Inspect Database |
processUser |
The user account logged on to the computer at the time of a detection trigger |
processCommandLine |
The argument used with the command |
processId |
Unique identifier of a process in ESET Inspect Database |
processUser |
The user account logged on at the time of the detection trigger |
resolved |
True/false; if user marked the detection as resolved |
ruleName |
The rule's name that triggered the detection |
ruleId |
A rule's integer ID |
ruleUuid |
A rule's Uuid ID |
severity |
Shows the detection severity |
severityScore |
A precise severity definition: 1–39 > Info 40–69 > Warning 70–100 > Threat |
threatName |
The threat's name, that can be found in this list http://www.virusradar.com/en/threat_encyclopaedia |
threatUri |
The URI (uniform resource identifier) that caused the detection to trigger |
type |
ESET type of the detections: UnknownAlarm = 0 RuleActivated = 1: rule-based detection MalwareFoundOnDisk = 2: malware found on disk by Endpoint MalwareFoundInMemory = 3: malware found in memory by Endpoint ExploitDetected = 4: exploit detected by Endpoint FirewallDetection = 5 BlockedAddress = 7: URL blocked by firewall CryptoBlockerDetection = 8: cryptoBlocker detection |
uuid |
A detection's unique identifier. |
List of detections - filtering
URL query:
$filter |
Allows the user to filter detections with an expression built from: Fields: id, resolved, creationTime Operators: eq, ne, gt, ge, lt, le, and, or, and () |
Example:
GET api/v1/detections?$filter=resolved eq false and creationTime ge 2020-01-20T20:11:00Z |
Get detection details
HTTP request:
GET api/v1/detections/{id} |
URL query:
$idType |
if $idType=sha1 {id} in URL is interpreted as sha1 of a module |
Request header: Authorization token
Request body: None
Response: JSON object with detection data:
computerId |
A computer's unique identifier in the ESET Inspect Database |
computerName |
The computer's name that raised the detection |
computerUuid |
A computer's unique identifier in the ESET Inspect Database |
creationTime |
The time of the detection |
handled |
Shows if action was taken against this detection |
id |
Unique detection identifier in the ESET Inspect Database |
moduleFirstSeenLocally |
When an executable was first seen on any computer |
moduleId |
An executable's unique identifier in the ESET Inspect Database |
moduleLastExecutedLocally |
When the executable was last executed on any computer |
moduleLgAge |
Number of days visible in the LiveGrid® |
moduleLgPopularity |
How many computers reported an executable to LiveGrid® |
moduleLgReputation |
A number from 1 to 9, indicating how safe the file is: 1–2 (red) is malicious, 3–7 (yellow) is suspicious, 8–9 (green) is safe |
moduleName |
The executable that triggered the detection. |
moduleSha1 |
The executable’s hash that triggered the detection |
moduleSignatureType |
Information on if and how the file is signed |
moduleSigner |
The file signer, if applicable |
note |
A comment |
priority |
The detection's priority ( default 0, otherwise set by the ESET Inspect Administrator) |
processCommandLine |
Shows the argument used with the command |
processId |
A process's unique identifier in the ESET Inspect Database |
processPath |
The disk path where the executable is located |
processUser |
The logged user's name when the detection triggered |
resolved |
True/false; if user marked the detection as resolved |
ruleName |
The rule's name that triggered the detection |
ruleId |
A rule's integer id |
ruleUuid |
A rule's Uuid id |
severity |
The detection's severity |
severityScore |
A precise severity definition: 1–39 > Info 40–69 > Warning 70–100 > Threat |
threatName |
The threat's name, that can be found in this list http://www.virusradar.com/en/threat_encyclopaedia |
threatUri |
The URI (uniform resource identifier) that caused the detection to trigger |
type |
ESET type of the detections: UnknownAlarm = 0 RuleActivated = 1: rule based detection MalwareFoundOnDisk = 2: malware found on disk by Endpoint MalwareFoundInMemory = 3: malware found in memory by Endpoint ExploitDetected = 4: exploit detected by Endpoint FirewallDetection = 5 BlockedAddress = 7: URL blocked by firewall CryptoBlockerDetection = 8: cryptoBlocker detection |
uuid |
A detection's unique identifier |
Update detection
HTTP request:
PATCH api/v1/detections/{id} |
URL query:
$idType |
if $idType=sha1 {id} in URL is interpreted as sha1 of a module |
Request header: Authorization token
Request body: JSON object with the following properties:
resolved |
When set to true, the detection is marked as resolved |
priority |
|
note |
Enable to add a note |