Mandiant Event Suppression API

openapi: 3.2.0
info:
  title: Mandiant Event Suppression API
  version: '1.0'
  description: 'Operations tagged Event Suppression across 4 of this provider''s published API definitions: mandiant-ma-sv-openapi.yml, mandiant-msv-openapi.yml, mandiant-ma-sv-openapi.yml, mandiant-msv-openapi.yml. Each path carries the servers of the definition it was published in.'
tags:
- name: Event Suppression
  description: The suppressed event API endpoints provide accessors to suppress and drop events.
paths:
  /suppressed_events/suppress:
    post:
      summary: Suppress the given Job Action events
      description: 'Suppress already-created Job Action events. Events cannot be suppressed within the operational window where events are still being matched with Job Actions

        (typically 15 minutes from when the Job Action has been executed).


        The response object will be an array of all Suppressed Events created from this operation.'
      tags:
      - Event Suppression
      parameters:
      - name: ja_event_ids
        description: 'The list of Job Action event IDs that will be converted to Suppressed Events.  These original Job Action events will be deleted from the system.

          '
        in: query
        required: true
        schema:
          type: string
        example: 15, 18, 23
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
              - id: 11
                job_action_id: 70
                integration_event_id: 48
                organization_id: 1
                created_at: '2021-09-09T20:53:30.358Z'
                updated_at: '2021-09-09T20:53:30.358Z'
                event_filter_rule_id: null
                integration_id: 2
      operationId: postSuppressedEventsSuppress
      x-operation-id-source: derived
  /suppressed_events/drop:
    post:
      summary: Drop the given Job Action events
      description: 'Drop already-created Job Action events. Events cannot be dropped within the operational window where events are still being matched with Job Actions

        (typically 15 minutes from when the Job Action has been executed).


        The response object will be an array of all Dropped Events created from this operation.'
      tags:
      - Event Suppression
      parameters:
      - name: ja_event_ids
        description: "The list of Job Action event IDs that will be converted to Dropped Events.  These original Job Action events will be deleted from the system.\nThe related Integration events will also be deleted unless they are connected to other Job Actions.  Dropped events will not be able to be \nconverted back into Job Action events at a later date.\n"
        in: query
        required: true
        schema:
          type: string
        example: 43
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
              - id: 136
                uid: 1dbb542d2300a2133b551dc964c26c15a057ea882025e0d8f2d478921e1b482a
                event_filter_rule_id: null
                created_at: '2021-09-09T20:48:59.782Z'
                updated_at: '2021-09-09T20:48:59.782Z'
                integration_id: 2
                job_action_id: 71
                organization_id: 1
      operationId: postSuppressedEventsDrop
      x-operation-id-source: derived
  /suppressed_events/job_action_details{id}:
    get:
      summary: Show the suppressed and dropped events for a given Job Action
      description: 'The response from this endpoint will be an array of Integration-partitioned objects that will detail the suppressed and dropped event

        information related to that Integration and the requested Job Action.


        The events that have been suppressed or dropped manually will be found in the Integration object with an empty ID (if any exist).'
      tags:
      - Event Suppression
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
              - integration_id: 2
                suppressed_events:
                  filter_rules:
                  - id: 2
                    filter_conditions:
                    - id: 2
                      match_object: SimAction
                      match_field: vid
                      created_at: '2021-07-07T20:56:47.839Z'
                      updated_at: '2021-07-30T11:21:48.419Z'
                      operator: in
                      value:
                      - A104-501
                    events:
                    - -- General event objects
                    created_by:
                      full_name: null
                    created_at: '2021-07-07T20:56:47.835Z'
                  individual: []
                dropped_events:
                  filter_rules:
                  - id: 2
                    filter_conditions:
                    - id: 2
                      match_object: SimAction
                      match_field: vid
                      created_at: '2021-07-07T20:56:47.839Z'
                      updated_at: '2021-07-30T11:21:48.419Z'
                      operator: in
                      value:
                      - A104-501
                    dropped_event_count: 128
                    created_by:
                      full_name: null
                    created_at: '2021-07-07T20:56:47.835Z'
                  individual_dropped_count: 0
      operationId: getSuppressedEventsJobActionDetails{id}
      x-operation-id-source: derived
  /suppressed_events/job_action_details_{id}:
    get:
      summary: Show the suppressed and dropped events for a given Job Action
      description: 'The response from this endpoint will be an array of Integration-partitioned objects that will detail the suppressed and dropped event

        information related to that Integration and the requested Job Action.


        The events that have been suppressed or dropped manually will be found in the Integration object with an empty ID (if any exist).'
      tags:
      - Event Suppression
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
              - integration_id: 2
                suppressed_events:
                  filter_rules:
                  - id: 2
                    filter_conditions:
                    - id: 2
                      match_object: SimAction
                      match_field: vid
                      created_at: '2021-07-07T20:56:47.839Z'
                      updated_at: '2021-07-30T11:21:48.419Z'
                      operator: in
                      value:
                      - A104-501
                    events:
                    - -- General event objects
                    created_by:
                      full_name: null
                    created_at: '2021-07-07T20:56:47.835Z'
                  individual: []
                dropped_events:
                  filter_rules:
                  - id: 2
                    filter_conditions:
                    - id: 2
                      match_object: SimAction
                      match_field: vid
                      created_at: '2021-07-07T20:56:47.839Z'
                      updated_at: '2021-07-30T11:21:48.419Z'
                      operator: in
                      value:
                      - A104-501
                    dropped_event_count: 128
                    created_by:
                      full_name: null
                    created_at: '2021-07-07T20:56:47.835Z'
                  individual_dropped_count: 0
      operationId: getSuppressedEventsJobActionDetails{id}
      x-operation-id-source: derived
x-refined-from:
- mandiant-ma-sv-openapi.yml
- mandiant-msv-openapi.yml
- mandiant-ma-sv-openapi.yml
- mandiant-msv-openapi.yml