Iru Threat Details API

openapi: 3.2.0
info:
  title: Iru Endpoint Management Threat Details API
  description: "# Welcome to the Iru Endpoint Management API Documentation\n\n**Note:** Kandji is in the process of changing to Iru. Many URLs and notes within this documentation will continue to reference Kandji for some time.\n\nYou can find your API URL in Settings > Access. The API URL will follow the below formats.\n\n- US - `https://SubDomain.api.kandji.io`\n    \n- EU - `https://SubDomain.api.eu.kandji.io`\n    \n\nFor information on how to obtain an API token, please refer to the Iru docs.\n\n[https://docs.iru.com/](https://docs.iru.com/)\n\n#### Rate Limit\n\nThe Iru Endpoint Management API currently has an API rate limit of 10,000 requests per hour per customer.\n\n#### Request Methods\n\nHTTP request methods supported by the API.\n\n| Method | Definition |\n| --- | --- |\n| GET | The `GET` method requests a representation of the specified resource. |\n| POST | The `POST` method submits an entity to the specified resource. |\n| PATCH | The `PATCH` method applies partial modifications to a resource. |\n| DELETE | The `DELETE` method deletes the specified resource. |\n\n#### Response codes\n\nNot all response codes apply to every endpoint.\n\n| Code | Response |\n| --- | --- |\n| 200 | OK |\n| 201 | Created |\n| 204 | No content |\n|  | Typical response when sending the DELETE method. |\n| 400 | Bad Request |\n|  | \"Command already running\" - The command may already be running in a _Pending_ state waiting on the device. |\n|  | \"Command is not allowed for current device\" - The command may not be compatible with the target device. |\n|  | \"JSON parse error - Expecting ',' delimiter: line 3 column 2 (char 65)\" |\n| 401 | Unauthorized |\n|  | This error can occur if the token is incorrect, was revoked, or the token has expired. |\n| 403 | Forbidden |\n|  | The request was understood but cannot be authorized. |\n| 404 | Not found |\n|  | Unable to locate the resource in the Iru tenant. |\n| 415 | Unsupported Media Type |\n|  | The request contains a media type which the server or resource does not support. |\n| 500 | Internal server error |\n| 503 | Service unavailable |\n|  | This error can occur if a file upload is still being processed via the custom apps API. |\n\n#### Data structure\n\nThe API returns all structured responses in JSON schema format.\n\n#### Examples\n\nCode examples using the API can be found in the Iru Endpoint Management support [GitHub](https://github.com/kandji-inc/support/tree/main/api-tools)."
  version: 1.0.0
servers:
- url: https://{subdomain}.api.kandji.io
  description: US Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
- url: https://{subdomain}.api.eu.kandji.io
  description: EU Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
security:
- BearerAuth: []
tags:
- name: Threat Details
paths:
  /api/v1/threat-details:
    get:
      summary: Get Threat Details
      description: Get threat details.
      parameters:
      - name: classification
        in: query
        required: false
        description: 'Return all records matching a specified classification. The following classification options are available: `malware` and `pup`. Leave this parameter empty to return all classification types. Example: `malware`'
        schema:
          type: string
          enum:
          - malware
          - pup
        example: malware
      - name: date_range
        in: query
        required: false
        description: 'Return all records within a specified number of days. Any positive number of days may be specified. Examples: `7`, `30`, `60`, `90`, `180`, or `365`. Example: `7`'
        schema:
          type: integer
          minimum: 1
        example: 7
      - name: device_id
        in: query
        required: false
        description: 'Search for a specific device by the device id (uuid). Example: `15fcec08-xxxx-xxxx-xxxx-7c2f950910eb`'
        schema:
          type: string
        example: 15fcec08-xxxx-xxxx-xxxx-7c2f950910eb
      - name: status
        in: query
        required: false
        description: 'Return all records matching a specified status. The following status options are available: `quarantined`, `not_quarantined`, or `released`. Leave this parameter empty to return all status types. Example: `quarantined`'
        schema:
          type: string
          enum:
          - quarantined
          - not_quarantined
          - released
        example: quarantined
      - name: sort_by
        in: query
        required: false
        description: 'Results can be sorted with the following options: `threat_name`, `classification`, `device_name`, `process_name`, `process_owner`, `detection_date`, `status`. Prepending a dash (-) to the parameter value will reverse the order of the returned results. Example: `status` or `-device_name`'
        schema:
          type: string
          enum:
          - threat_name
          - classification
          - device_name
          - process_name
          - process_owner
          - detection_date
          - status
        example: status
      - name: term
        in: query
        required: false
        description: 'Search term to filter threat results. The response will include anything matching the following fields: `device_name`, `file_hash`, and `file_path`. Example: `Chrome`'
        schema:
          type: string
        example: Chrome
      - name: limit
        in: query
        required: false
        description: 'A hard upper `limit` is set at 1000 records returned per request. If more records are expected, pagination should be used using the `limit` and `offset` parameters. Example: `1000`'
        schema:
          type: integer
          maximum: 1000
          default: 1000
        example: 1000
      - name: offset
        in: query
        required: false
        description: 'Specify the starting record to return. Example: `1`'
        schema:
          type: integer
          minimum: 0
          default: 0
        example: 1
      responses:
        '200':
          description: using term param
          content:
            application/json:
              schema:
                type: object
                example:
                  count: 24
                  next: null
                  previous: null
                  malware_count: 24
                  pup_count: 0
                  results:
                  - threat_name: malware_5
                    classification: MALWARE
                    status: QUARANTINED
                    process_name: chmod
                    process_owner: root
                    device_name: accuhive MacBook Air
                    device_id: df1badd0-1dc9-448b-9b2a-c614a844c69e
                    detection_date: '2023-04-21T17:23:13.883134'
                    date_of_quarantine: '2023-04-21T17:23:15.071621'
                    date_of_release: ''
                    released_by: ''
                    release_note: ''
                    file_path: /Users/Shared/malware/malware_5
                    file_hash: 2ab79665b07b3be11dd1d4f2d0bafa886a4b393b28ffedb2a02f62efd0061858
                    bundle_path: ''
                    device_serial_number: FVFGHGK7Q6L7
                    blueprint_id: 396cdae2-147e-4e61-8a27-2f6b6963da4f
                    blueprint_name: Threat
                    library_item_name: Avert
                    library_item_id: d0afe50a-1102-4568-86ed-44863b757c85
                    pup_posture: protect
                    malware_posture: protect
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Unauthorized
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Not Found
      tags:
      - Threat Details
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT