Chaitin Tech ueba/log/{ueba_category}/list API
UEBA 分析/日志/ueba_category 参数/列表
OpenAPI Specification
openapi: 3.0.3
info:
title: APISec Management account ueba/log/{ueba_category}/list API
version: '26.05'
description: Generated from APISec skyview APIView classes.
tags:
- name: ueba/log/{ueba_category}/list
description: UEBA 分析/日志/ueba_category 参数/列表
paths:
/ueba/log/{ueba_category}/list:
post:
summary: UEBA事件列表
deprecated: false
description: ''
tags:
- ueba/log/{ueba_category}/list
parameters:
- name: ueba_category
in: path
description: ''
required: true
example: string
schema:
type: string
- name: X-CS-Header-App
in: header
description: 应用id
required: true
example: '{{app}}'
schema:
type: string
- name: X-CS-Header-Company
in: header
description: 公司id
required: true
example: '{{company_id}}'
schema:
type: string
- name: X-CS-Header-Crypt
in: header
description: 加密算法，请参考：https://servaltech.feishu.cn/docs/doccnQCZ2cw32uazgNSO0DFwceb
required: true
example: ''
schema:
type: string
- name: If-None-Match
in: header
description: 对于支持「ETAG」的接口，将上一次请求的响应header的Etag，填入到下一次请求。若匹配，则返回304（无变更），否则会返回新版本的数据 + 新Etag
required: true
example: string
schema:
type: string
- name: X-CS-Header-Debug
in: header
description: ''
required: true
example: '{{debug}}'
schema:
type: string
- name: Accept-Language
in: header
description: ''
required: true
example: zh
schema:
type: string
- name: X-Cs-Header-Timezone
in: header
description: ''
required: true
example: Asia/Shanghai
schema:
type: string
- name: Content-Type
in: header
description: ''
required: true
example: application/json
schema:
type: string
- name: Accept
in: header
description: ''
required: true
example: application/json
schema:
type: string
requestBody:
content:
application/json:
schema:
type: object
properties:
time_range:
type: object
properties:
begin:
type: string
end:
type: string
required:
- begin
- end
search:
type: string
queries:
type: array
items:
type: object
properties:
field:
type: string
operator:
type: string
value:
type: string
required:
- time_range
- search
- queries
example:
time_range:
begin: '2023-11-28 20:00:00'
end: '2024-11-28 21:00:00'
search: ''
queries:
- field: ueba_source
operator: is
value: policy_channel_log
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
code:
type: integer
msg:
type: string
data:
type: object
properties:
index:
type: array
items:
type: string
page:
type: integer
limit:
type: integer
search_total:
type: integer
total:
type: integer
search_after:
type: array
items:
type: integer
results:
type: array
items:
type: object
properties:
status:
type: string
category:
type: string
device_id:
type: string
device_code:
type: string
ip_address:
type: string
console_user:
type: string
os_name:
type: string
os_friendly_name:
type: string
staff_id:
type: string
staff_name:
type: string
staff_code:
type: string
staff_email:
type: string
staff_description:
type: string
staff_tag_ids:
type: array
items: {}
staff_tags:
type: array
items: {}
dept_ids:
type: array
items:
type: string
dept_names:
type: array
items:
type: string
dept_paths:
type: array
items:
type: string
event_id:
type: string
agent_version:
type: string
company_id:
type: string
policy_id:
type: string
log_cnt:
type: integer
layer_values:
type: object
properties:
filename:
type: string
staff_id:
type: string
required:
- filename
- staff_id
timestamp:
type: string
'@timestamp':
type: integer
begin:
type: string
begin_timestamp:
type: integer
end:
type: string
end_timestamp:
type: integer
ueba_id:
type: string
ueba_name:
type: string
ueba_status:
type: string
ueba_source:
type: string
ueba_category:
type: string
ueba_description:
type: string
ueba_expression_fields:
type: object
properties:
aggs:
type: object
properties:
layers:
type: array
items:
type: string
threshold:
type: integer
required:
- layers
- threshold
queries:
type: array
items: {}
body:
type: object
properties:
aggs:
type: object
properties:
bucket:
type: object
properties:
aggs:
type: object
properties:
filename:
type: object
properties:
aggs:
type: object
properties:
staff_id:
type: object
properties:
aggs:
type: object
properties:
end:
type: object
properties:
max:
type: object
properties:
field:
type: string
required:
- field
required:
- max
info:
type: object
properties:
top_hits:
type: object
properties:
size:
type: integer
required:
- size
required:
- top_hits
begin:
type: object
properties:
min:
type: object
properties:
field:
type: string
required:
- field
required:
- min
staff_id_bucket_filter:
type: object
properties:
bucket_selector:
type: object
properties:
script:
type: string
buckets_path:
type: object
properties:
cnt:
type: string
required:
- cnt
required:
- script
- buckets_path
required:
- bucket_selector
required:
- end
- info
- begin
- staff_id_bucket_filter
terms:
type: object
properties:
size:
type: integer
field:
type: string
required:
- size
- field
required:
- aggs
- terms
empty_bucket_filter:
type: object
properties:
bucket_selector:
type: object
properties:
script:
type: string
buckets_path:
type: object
properties:
cnt:
type: string
required:
- cnt
required:
- script
- buckets_path
required:
- bucket_selector
required:
- staff_id
- empty_bucket_filter
terms:
type: object
properties:
size:
type: integer
field:
type: string
required:
- size
- field
required:
- aggs
- terms
empty_bucket_filter:
type: object
properties:
bucket_selector:
type: object
properties:
script:
type: string
buckets_path:
type: object
properties:
cnt:
type: string
required:
- cnt
required:
- script
- buckets_path
required:
- bucket_selector
required:
- filename
- empty_bucket_filter
terms:
type: object
properties:
size:
type: integer
field:
type: string
required:
- size
- field
required:
- aggs
- terms
required:
- bucket
query:
type: object
properties:
bool:
type: object
properties:
must:
type: array
items:
type: object
properties:
bool:
type: object
properties:
must_not:
type: array
items:
type: object
properties:
term:
type: object
properties:
action:
type: string
required:
- action
required:
- term
required:
- must_not
term:
type: object
properties:
company_id:
type: string
required:
- company_id
required:
- bool
- term
required:
- must
required:
- bool
track_total_hits:
type: boolean
required:
- aggs
- query
- track_total_hits
required:
- aggs
- body
- queries
ueba_expression:
type: string
ueba_score:
type: integer
ueba_windows_s:
type: integer
ueba_threshold:
type: integer
ueba_baseline:
type: integer
time:
type: integer
uid:
type: string
_type:
type: string
_index:
type: string
required:
- status
- category
- device_id
- device_code
- ip_address
- console_user
- os_name
- os_friendly_name
- staff_id
- staff_name
- staff_code
- staff_email
- staff_description
- staff_tag_ids
- staff_tags
- dept_ids
- dept_names
- dept_paths
- event_id
- agent_version
- company_id
- policy_id
- log_cnt
- layer_values
- timestamp
- '@timestamp'
- begin
- begin_timestamp
- end
- end_timestamp
- ueba_id
- ueba_name
- ueba_status
- ueba_source
- ueba_category
- ueba_description
- ueba_expression_fields
- ueba_expression
- ueba_score
- ueba_windows_s
- ueba_threshold
- ueba_baseline
- time
- uid
- _type
- _index
required:
- index
- page
- limit
- search_total
- total
- search_after
- results
required:
- code
- msg
- data
example:
code: 0
msg: success
data:
index:
- qzhddr_ueba
page: 1
limit: 100
search_total: 610
total: 610
search_after:
- 1704793200187
results:
- status: created
category: channel
device_id: 44089618-2db4-4bbf-83b7-2bffb35c3b59
device_code: PC-000030
ip_address: 192.168.96.92
console_user: serval-PC\serval
os_name: UOS
os_friendly_name: UnionTech OS Desktop 20 Pro
staff_id: db5a6924-fe54-453e-8f9c-a6ce7ba5ccca
staff_name: 周紫莹
staff_code: '+8618379323037'
staff_email: ziying.zhou@mcfuwuqi.top
staff_description: ''
staff_tag_ids: []
staff_tags: []
dept_ids:
- 282cfac5-94a1-4d2c-ade8-f8b0538bde11
dept_names:
- default
dept_paths:
- default
event_id: 964734cf-6883-4812-b8aa-51780c2800ca
agent_version: 3.1.9
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
policy_id: ebe7578c-1ca0-4a01-8c72-f61bd6b67ec2
log_cnt: 332
layer_values:
filename: fcitx-log.log_serval
staff_id: db5a6924-fe54-453e-8f9c-a6ce7ba5ccca
timestamp: '2024-01-10T11:31:03Z'
'@timestamp': 1704886263101
begin: '2023-11-30T01:56:10Z'
begin_timestamp: 1701309370000
end: '2023-11-30T01:56:10Z'
end_timestamp: 1701310129000
ueba_id: 6c869462-a480-46b5-9be2-888ff951fca2
ueba_name: test3
ueba_status: activated
ueba_source: policy_channel_log
ueba_category: outgoing
ueba_description: ''
ueba_expression_fields:
aggs:
layers:
- filename
- staff_id
threshold: 1
queries: []
ueba_expression: SELF
ueba_score: 60
ueba_windows_s: 90000000
ueba_threshold: 1
ueba_baseline: 332
time: 1704886263101
uid: ujgj84wBWc_lYpg23bfx
_type: _doc
_index: .ds-qzhddr_ueba_s-2024.01.08-000001
- status: created
category: channel
device_id: 44089618-2db4-4bbf-83b7-2bffb35c3b59
device_code: PC-000030
ip_address: 192.168.96.92
console_user: serval-PC\serval
os_name: UOS
os_friendly_name: UnionTech OS Desktop 20 Pro
staff_id: db5a6924-fe54-453e-8f9c-a6ce7ba5ccca
staff_name: 周紫莹
staff_code: '+8618379323037'
staff_email: ziying.zhou@mcfuwuqi.top
staff_description: ''
staff_tag_ids: []
staff_tags: []
dept_ids:
- 282cfac5-94a1-4d2c-ade8-f8b0538bde11
dept_names:
- default
dept_paths:
- default
event_id: 964734cf-6883-4812-b8aa-51780c2800ca
agent_version: 3.1.9
company_id: eeff7c64-5070-4582-8b93-fbcc57db7771
policy_id: ebe7578c-1ca0-4a01-8c72-f61bd6b67ec2
log_cnt: 332
layer_values:
filename: fcitx-log.log_serval
staff_id: db5a6924-fe54-453e-8f9c-a6ce7ba5ccca
timestamp: '2024-01-10T11:30:04Z'
'@timestamp': 1704886204158
begin: '2023-11-30T01:56:10Z'
begin_timestamp: 1701309370000
end: '2023-11-30T01:56:10Z'
end_timestamp: 1701310129000
ueba_id: 6c869462-a480-46b5-9be2-888ff951fca2
ueba_name: test3
ueba_status: activated
ueba_source: policy_channel_log
ueba_category: outgoing
ueba_description: ''
ueba_expression_fields:
aggs:
layers:
- filename
- staff_id
threshold: 1
queries: []
ueba_expression: SELF
ueba_score: 60
ueba_windows_s: 90000000
ueba_threshold: 1
ueba_baseline: 332
time: 1704886204158
uid: pjgi84wBWc_lYpg297ek
_type: _doc
_index: .ds-qzhddr_ueba_s-2024.01.08-00000
# --- truncated at 32 KB (504 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/chaitin/refs/heads/main/openapi/chaitin-ueba-log-ueba-category-list-api-openapi.yml