McAfee (Trellix) Events API

openapi: 3.2.0
info:
  title: McAfee ESM Events API
  description: McAfee Enterprise Security Manager (ESM) SIEM REST API for managing security events, alarms, watchlists, data sources, and executing queries against the event database for security monitoring and incident response.
  version: '11.0'
  contact:
    name: McAfee Support
    url: https://www.mcafee.com/enterprise/en-us/support.html
  termsOfService: https://www.mcafee.com/enterprise/en-us/about/legal/terms-of-use.html
servers:
- url: https://{esm-server}/rs/esm
  description: McAfee ESM Server
  variables:
    esm-server:
      default: your-esm-server
      description: Hostname or IP of the ESM server
security:
- sessionAuth: []
tags:
- name: Events
  description: Query and retrieve security events
paths:
  /v2/qryExecuteDetail:
    post:
      operationId: executeQuery
      summary: McAfee Execute an event query
      description: Execute a query against the ESM event database to retrieve security events matching specified criteria. Returns a result ID for fetching results asynchronously.
      tags:
      - Events
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - config
              properties:
                config:
                  type: object
                  properties:
                    timeRange:
                      type: string
                      enum:
                      - LAST_10_MINUTES
                      - LAST_HOUR
                      - LAST_24_HOURS
                      - LAST_WEEK
                      - LAST_MONTH
                      - CUSTOM
                      description: Query time range
                    customStart:
                      type: string
                      format: date-time
                      description: Custom start time
                    customEnd:
                      type: string
                      format: date-time
                      description: Custom end time
                    fields:
                      type: array
                      items:
                        type: object
                        properties:
                          name:
                            type: string
                            description: Field name
                      description: Fields to return in results
                    filters:
                      type: array
                      items:
                        type: object
                        properties:
                          type:
                            type: string
                            description: Filter type
                          field:
                            type: object
                            properties:
                              name:
                                type: string
                          value:
                            type: string
                      description: Query filters
                    limit:
                      type: integer
                      description: Maximum number of results
                      default: 100
      responses:
        '200':
          description: Query initiated, result ID returned
          content:
            application/json:
              schema:
                type: object
                properties:
                  resultID:
                    type: integer
                    description: Result ID for fetching query results
        '400':
          description: Invalid query
        '401':
          description: Not authenticated
  /v2/qryGetResults:
    post:
      operationId: getQueryResults
      summary: McAfee Get query results
      description: Retrieve the results of a previously executed query using the result ID. May need to be called multiple times as results become available.
      tags:
      - Events
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - resultID
              properties:
                resultID:
                  type: integer
                  description: Result ID from executeQuery
                startPos:
                  type: integer
                  description: Starting position for pagination
                  default: 0
                numRows:
                  type: integer
                  description: Number of rows to return
                  default: 50
      responses:
        '200':
          description: Query results
          content:
            application/json:
              schema:
                type: object
                properties:
                  columns:
                    type: array
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                    description: Column definitions
                  rows:
                    type: array
                    items:
                      type: object
                      properties:
                        values:
                          type: array
                          items:
                            type: string
                    description: Result rows
                  totalRows:
                    type: integer
                    description: Total number of matching rows
                  complete:
                    type: boolean
                    description: Whether the query has completed
        '401':
          description: Not authenticated
        '404':
          description: Result ID not found
components:
  securitySchemes:
    sessionAuth:
      type: apiKey
      in: cookie
      name: JWTToken
      description: Session token obtained from the login endpoint
externalDocs:
  description: McAfee ESM API Reference Guide
  url: https://docs.mcafee.com/bundle/enterprise-security-manager-api-reference-guide