LevelBlue Events API

openapi: 3.0.0
info:
  title: USM Anywhere™ API Reference Alarms Events API
  description: AT&T Cybersecurity publishes REST APIs for USM Anywhere that provide a programmatic interface that will allow you to access your data directly from your own applications and extensions.
  version: '2.0'
servers:
- url: https://your-subdomain.alienvault.cloud/api/2.0
  description: USM Anywhere API Server
security:
- bearerAuth: []
tags:
- name: Events
  description: Endpoints for managing and searching events.
paths:
  /events:
    get:
      tags:
      - Events
      summary: Get a page of events
      description: Retrieves a paginated list of events, which can be filtered by various parameters.
      parameters:
      - name: page
        in: query
        description: The page number of results to return (zero-based).
        schema:
          type: integer
      - name: size
        in: query
        description: The number of results to return per page.
        schema:
          type: integer
      - name: sort
        in: query
        description: The parameter and direction to sort results by.
        schema:
          type: string
          example: timestamp_occured,asc
      - name: account_name
        in: query
        required: true
        description: The account name.
        schema:
          type: string
      - name: suppressed
        in: query
        description: Filter events by the suppressed flag.
        schema:
          type: boolean
      - name: plugin
        in: query
        description: The plugin name.
        schema:
          type: string
      - name: event_name
        in: query
        description: The name of the event.
        schema:
          type: string
      - name: source_name
        in: query
        description: The source name.
        schema:
          type: string
      - name: sensor_uuid
        in: query
        description: The UUID of the sensor.
        schema:
          type: string
          format: uuid
      - name: source_username
        in: query
        description: The username of the person that triggered the event.
        schema:
          type: string
      - name: timestamp_occured_gte
        in: query
        description: Filter for events that occurred at or after this timestamp (epoch milliseconds).
        schema:
          type: integer
          format: int64
      - name: timestamp_occured_lte
        in: query
        description: Filter for events that occurred at or before this timestamp (epoch milliseconds).
        schema:
          type: integer
          format: int64
      responses:
        '200':
          description: A paginated list of events.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventPage'
              example:
                _links:
                  self:
                    href: https://mysubdomain.alienvault.cloud/api/2.0/events
                _embedded:
                  events:
                  - uuid: 39a6918f-33f2-ec9b-0fcc-42bb90f10a1f
                page:
                  size: 20
                  totalElements: 3506
                  totalPages: 176
                  number: 0
  /events/{eventId}:
    get:
      tags:
      - Events
      summary: Get Event Details
      description: Retrieves the full details for a single event by its UUID.
      parameters:
      - name: eventId
        in: path
        required: true
        description: The UUID of the event to retrieve.
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Event details retrieved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
              example:
                uuid: 39a6918f-33f2-ec9b-0fcc-42bb90f10a1f
                account_name: generic-account
                event_name: PutObject
                timestamp_occured: '1528817037000'
                _links:
                  self:
                    href: https://mysubdomain.aveng.us/api/2.0/events/39a6918f-33f2-ec9b-0fcc-42bb90f10a1f
        '404':
          description: Event not found.
components:
  schemas:
    EventPage:
      type: object
      properties:
        _links:
          $ref: '#/components/schemas/PageLinks'
        _embedded:
          $ref: '#/components/schemas/EmbeddedEvents'
        page:
          $ref: '#/components/schemas/PageDetail'
      required:
      - _links
      - _embedded
      - page
    HalLink:
      type: object
      properties:
        href:
          type: string
          format: uri
        templated:
          type: boolean
      required:
      - href
    PageDetail:
      type: object
      properties:
        size:
          type: integer
        totalElements:
          type: integer
        totalPages:
          type: integer
        number:
          type: integer
      required:
      - size
      - totalElements
      - totalPages
      - number
    PageLinks:
      type: object
      properties:
        self:
          $ref: '#/components/schemas/HalLink'
        first:
          $ref: '#/components/schemas/HalLink'
        last:
          $ref: '#/components/schemas/HalLink'
        next:
          $ref: '#/components/schemas/HalLink'
        prev:
          $ref: '#/components/schemas/HalLink'
    Event:
      type: object
      description: This object contains all information pertaining to an Event. Its structure can vary.
      additionalProperties: true
    EmbeddedEvents:
      type: object
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/Event'
      required:
      - events
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT