Mandiant

Mandiant Integration Events API

Events that came from an integration configured on the Director. This does not include events that come from local logs for Host CLI Actions.

Documentation GitHub OpenAPI

Operations 1

GET /integration_events List Integration Events #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/mandiant:mandiant-integration-events-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Mandiant Integration Events API
  version: '1.0'
  description: 'Operations tagged Integration Events across 4 of this provider''s published API definitions: mandiant-ma-sv-openapi.yml, mandiant-msv-openapi.yml, mandiant-ma-sv-openapi.yml, mandiant-msv-openapi.yml. Each path carries the servers of the definition it was published in.'
tags:
- name: Integration Events
  description: Events that came from an integration configured on the Director. This does not include events that come from local logs for Host CLI Actions.
paths:
  /integration_events:
    get:
      summary: List Integration Events
      description: Get an array of IntegrationEvent objects, optionally filtered by certain values. Events are returned in order of descending ID.
      tags:
      - Integration Events
      parameters:
      - name: filter[id]
        in: query
        description: 'An integer, array of integers, or comma-separated string of integers indicating the IntegrationEvent ID(s) to filter on.

          '
        schema:
          oneOf:
          - type: string
          - type: integer
          - type: array
      - name: filter[job_action_id]
        in: query
        description: 'An integer, array of integers, or comma-separated string of integers indicating the JobAction ID(s) to filter on

          '
        schema:
          oneOf:
          - type: string
          - type: integer
          - type: array
      - name: filter[integration_id]
        in: query
        description: 'An integer, array of integers, or comma-separated string of integers indicating the Integration ID(s) to filter on

          '
        schema:
          oneOf:
          - type: string
          - type: integer
          - type: array
      responses:
        '200':
          description: Success
          content:
            application/json:
              example:
                Request:
                - id: 629413
                  src_ip: 192.168.45.1
                  dest_ip: 192.168.45.162
                  start_time: '2020-02-03T18:22:55.000Z'
                  end_time: null
                  host: 10.0.8.9
                  uid: '183:16'
                  description: ET TROJAN Likely Zbot Generic Post to gate.php Dotted-Quad
                  event_count: null
                  src_port: 56693
                  dest_port: 1236
                  email_subject: null
                  url: null
                  sid: 1:2022986:2
                  integration_type: null
                  integration_id: 97
                  raw_event: 'Feb  3 18:22:55  [1:2022986:2] ET TROJAN Likely Zbot Generic Post to gate.php Dotted-Quad [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.45.1:56693 -> 192.168.45.162:1236'
                  base_event_uids: []
                  aggregated_event_uids: []
                  matched_rule: null
                  created_at: '2020-02-03T18:23:05.889Z'
                  updated_at: '2020-02-03T18:23:05.889Z'
                  event_source: suricata
                  email_sender: null
                  email_recipient: null
                  user: null
                  computer: null
                  old_integration_id: null
                  untranslated:
                    src_ip: 192.168.45.1
                    dest_ip: 192.168.45.162
                    sig_id: 1:2022986:2
                    src_port: '56693'
                    dest_port: '1236'
                    name: ET TROJAN Likely Zbot Generic Post to gate.php Dotted-Quad
                    host: 10.0.8.9
                    index: main
                    _bkt: main~183~7B369B58-F573-48DA-A16A-DED1DFB1A458
                    _cd: '183:16'
                    _indextime: '1580754178'
                    _kv: '1'
                    _raw: 'Feb  3 18:22:55  [1:2022986:2] ET TROJAN Likely Zbot Generic Post to gate.php Dotted-Quad [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 192.168.45.1:56693 -> 192.168.45.162:1236'
                    _serial: '4'
                    _si:
                    - ubuntu
                    - main
                    _sourcetype: suricata
                    _time: 2020-02-03 18:22:55.000 UTC
                  action: null
                  filehashes: null
      operationId: getIntegrationEvents
      x-operation-id-source: derived
x-refined-from:
- mandiant-ma-sv-openapi.yml
- mandiant-msv-openapi.yml
- mandiant-ma-sv-openapi.yml
- mandiant-msv-openapi.yml