Mandiant

Mandiant Alert Audit API

The Alert Audit API from Mandiant — 2 operation(s) for alert audit.

Documentation GitHub OpenAPI

Operations 2

GET /alerts/{id}/audit List audit records for a given alert #

GET /alerts/audit List alert audit records #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/mandiant:mandiant-alert-audit-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Mandiant Alert Audit API
  version: '1.0'
  contact: {}
  description: 'Operations tagged Alert Audit across 2 of this provider''s published API definitions: mandiant-dtm-openapi.yml, mandiant-dtm-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.intelligence.mandiant.com/v4/dtm
security:
- My_API_Key: []
tags:
- name: Alert Audit
paths:
  /alerts/{id}/audit:
    get:
      description: Get alert audit records for a given alert. This API uses the next link header to provide the URI of the next page of results. When fetching subsequent pages, only use the link header URI.
      operationId: get-alert-audit
      parameters:
      - description: The accept type of the response body.
        in: header
        name: Accept
        required: true
        schema:
          default: application/json
          example: application/json
          type: string
      - description: The ID for the alert to get the audit records for.
        in: path
        name: id
        required: true
        schema:
          example: c4huif0mhcmiku5g7jsg
          type: string
      - description: The alert operation field name to sort the response by.
        in: query
        name: sort
        schema:
          default: alert_id
          enum:
          - alert_id
          - history_created_at
          - operation
          type: string
      - description: The order used to sort the response alerts field by.
        in: query
        name: order
        schema:
          default: desc
          enum:
          - asc
          - desc
          example: asc
          type: string
      - description: The number of alerts to return in each page. Max value of 100.
        in: query
        name: size
        schema:
          default: 10
          example: 20
          type: integer
      - description: When listing by date range, since defines the starting date in RFC3339 format
        in: query
        name: since
        schema:
          format: date-time
          type: string
      - description: When listing by date range, until defines the ending date in RFC3339 format
        in: query
        name: until
        schema:
          format: date-time
          type: string
      - description: Only used when fetching subsequent pages during pagination and will contain a unique page ID. No other query parameters can be used with page
        in: query
        name: page
        schema:
          type: string
      - description: Filter by operation. This parameter can be specified multiple times.
        in: query
        name: operation
        schema:
          enum:
          - read
          - update
          - rollback
          - delete
          - update_analysis
          - delete_analysis
          - create_attachment
          - delete_attachment
          - add_tags
          - remove_tags
          - download
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                list-alerts:
                  value:
                    history:
                    - alert_id: cmuh3gc77f5qjuh393s0
                      history_created_at: 2024-02-02 16:01:14.868000+00:00
                      id: cmuh3im6ilcc4m24o070
                      monitor_id: cmkjgpondpooldkse410
                      operation: read
                      previous_status: read
                      tenant_id: 5541ab0d-f16a-4354-b025-1239048935
                      to_status: read
                      user_email: John Doe
                      user_id: 1239048935-6ca8-103c-9ee0-4bc16e027a2d
                    - alert_id: cmuh3gc77f5qjuh393s0
                      history_created_at: 2024-02-02 16:01:11.740000+00:00
                      id: cmuh3hu6ilcc4m24o060
                      monitor_id: cmkjgpondpooldkse410
                      operation: update
                      previous_status: new
                      tenant_id: 5541ab0d-f16a-4354-b025-1239048935
                      to_status: read
                      user_email: Jane Smith
                      user_id: 1239048935-6ca8-103c-9ee0-4bc16e027a2d
              schema:
                $ref: '#/components/schemas/AlertAuditRecords'
          description: OK
          headers:
            Content-Type:
              description: The content type of the response body.
              schema:
                default: application/json
                example: application/json
                type: string
            Link:
              description: If another page of results is available for pagination, the Link header will contain the URI used to fetch the next page.
              schema:
                example: <https://api.intelligence.mandiant.com/v4/dtm/alerts/cmuh3gc77f5qjuh393s0/audit?page=c52e5bc1hrv40t8d0gvg>; rel="next"
                type: string
        '400':
          content:
            application/json:
              examples:
                bad-request:
                  value:
                    message: Bad Request
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: Unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
        '500':
          content:
            application/json:
              examples:
                internal-error:
                  value:
                    message: Internal Error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
      summary: List audit records for a given alert
      tags:
      - Alert Audit
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
  /alerts/audit:
    get:
      description: Get alert audit records. This API uses the next link header to provide the URI of the next page of results. When fetching subsequent pages, only use the link header URI.
      operationId: get-all-alert-audit
      parameters:
      - description: The accept type of the response body.
        in: header
        name: Accept
        required: true
        schema:
          default: application/json
          example: application/json
          type: string
      - description: The alert operation field name to sort the response by.
        in: query
        name: sort
        schema:
          default: alert_id
          enum:
          - alert_id
          - history_created_at
          - operation
          type: string
      - description: The order used to sort the response alerts field by.
        in: query
        name: order
        schema:
          default: desc
          enum:
          - asc
          - desc
          example: asc
          type: string
      - description: The number of alerts to return in each page. Max value of 100.
        in: query
        name: size
        schema:
          default: 10
          example: 20
          type: integer
      - description: When listing by date range, since defines the starting date in RFC3339 format
        in: query
        name: since
        schema:
          format: date-time
          type: string
      - description: When listing by date range, until defines the ending date in RFC3339 format
        in: query
        name: until
        schema:
          format: date-time
          type: string
      - description: Only used when fetching subsequent pages during pagination and will contain a unique page ID. No other query parameters can be used with page
        in: query
        name: page
        schema:
          type: string
      - description: Filter by operation. This parameter can be specified multiple times.
        in: query
        name: operation
        schema:
          enum:
          - read
          - update
          - rollback
          - delete
          - update_analysis
          - delete_analysis
          - create_attachment
          - delete_attachment
          - add_tags
          - remove_tags
          - download
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                list-alert-audit:
                  value:
                    history:
                    - alert_id: cmuh3gc77f5qjuh393s0
                      history_created_at: 2024-02-02 16:01:14.868000+00:00
                      id: cmuh3im6ilcc4m24o070
                      monitor_id: cmkjgpondpooldkse410
                      operation: read
                      previous_status: read
                      tenant_id: 5541ab0d-f16a-4354-b025-1239048935
                      to_status: read
                      user_email: John Doe
                      user_id: 1239048935-6ca8-103c-9ee0-4bc16e027a2d
                    - alert_id: cmuh1tc77f5qjuh392l0
                      history_created_at: 2024-02-02 16:01:11.740000+00:00
                      id: cmuh3hu6ilcc4m24o060
                      monitor_id: cmkjgpondpooldkse410
                      operation: update
                      previous_status: new
                      tenant_id: 5541ab0d-f16a-4354-b025-1239048935
                      to_status: read
                      user_email: Jane Smith
                      user_id: 1239048935-6ca8-103c-9ee0-4bc16e027a2d
              schema:
                $ref: '#/components/schemas/AlertAuditRecords'
          description: OK
          headers:
            Content-Type:
              description: The content type of the response body.
              schema:
                default: application/json
                example: application/json
                type: string
            Link:
              description: If another page of results is available for pagination, the Link header will contain the URI used to fetch the next page.
              schema:
                example: <https://api.intelligence.mandiant.com/v4/dtm/alerts/audit?page=c52e5bc1hrv40t8d0gvg>; rel="next"
                type: string
        '400':
          content:
            application/json:
              examples:
                bad-request:
                  value:
                    message: Bad Request
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Bad Request
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    message: Unauthorized
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Unauthorized
        '500':
          content:
            application/json:
              examples:
                internal-error:
                  value:
                    message: Internal Error
              schema:
                $ref: '#/components/schemas/Response-message'
          description: Internal Server Error
      summary: List alert audit records
      tags:
      - Alert Audit
    servers:
    - url: https://api.intelligence.mandiant.com/v4/dtm
components:
  schemas:
    Response-message:
      description: Error response message.
      properties:
        message:
          description: The response message.
          type: string
      title: Error Response
      type: object
    AlertAuditRecord:
      description: Metadata regarding an operation performed on an alert.
      properties:
        alert_id:
          description: The ID of the alert that was operated on.
          readOnly: true
          type: string
        history_created_at:
          description: The time the operation was performed.
          format: date-time
          readOnly: true
          type: string
        id:
          description: The ID of the audit record.
          readOnly: true
          type: string
        monitor_id:
          description: The ID of the monitor that created the alert.
          readOnly: true
          type: string
        operation:
          description: The operation performed on the alert.
          enum:
          - read
          - update
          - rollback
          - delete
          - update_analysis
          - delete_analysis
          - create_attachment
          - delete_attachment
          - add_tags
          - remove_tags
          - download
          readOnly: true
          type: string
        previous_status:
          description: The status of the alert prior to the operation.
          readOnly: true
          type: string
        to_status:
          description: The status of the alert after the operation.
          readOnly: true
          type: string
        user_email:
          description: The username that performed the operation.
          readOnly: true
          type: string
        user_id:
          description: The ID of the user that performed the operation.
          readOnly: true
          type: string
      title: Alert Audit Record
      type: object
    AlertAuditRecords:
      description: List of alert audit records.
      properties:
        history:
          description: The list of alert audit records.
          items:
            $ref: '#/components/schemas/AlertAuditRecord'
          type: array
      title: Alert Audit Records
      type: object
  securitySchemes:
    My_API_Key:
      scheme: bearer
      type: http
x-refined-from:
- mandiant-dtm-openapi.yml
- mandiant-dtm-openapi.yml