ThreatML

Overview

This method enables you to list and filter anomalies for your organization. If you do not add parameters to your query, then Distributed Cloud AIP returns all anomalies.

By default, anomalies are ordered by time in descending order so you see the most recent anomalies first. If there are more than 20 results in the query, then the API automatically paginates the results. You access the additional pages through a token number that Distributed Cloud AIP provides.

Sample Queries

List all anomalies:

https://api.threatstack.com/v2/anomalies/process

List all anomalies associated with events that matched at least one rule:

https://api.threatstack.com/v2/anomalies/process/?hasRuleMatch=true

Error Handling Tips

The 400 error code means that the request was unable to be fulfilled due to invalid data in the request body. Sample Error messages:

• The hasRuleMatch parameter should have a valid Boolean value, if one is provided.
• The agentId parameter should have a valid UUID value, if one is provided.
• The maxUserScore.gt parameter should have a valid floating point number between 0.0 and 1.0, if one is provided.
• The orgScore.gt parameter should have a valid floating point number between 0.0 and 1.0, if one is provided.
• The token parameter should be a valid token that Distributed Cloud AIP provides, if one is provided.

Overview

This method enables you to get details and additional context for a specific anomaly. Additional context includes:

• Agent
• Rule
• User
• Frequency (number of occurrences by hour)

NOTE

• Full Context is returned by default. To disable this, set the verbose parameter to false
• The Distributed Cloud AIP anomaly detection system only considers active rules and discards suppressed rules when processing events and associating events with anomalies

Sample Queries

Get details and full context for an anomaly by ID:

https://api.threatstack.com/v2/anomalies/process/f0a3a677-b265-4654-af31-1effd5cba063

Get the anomaly details without additional context:

https://api.threatstack.com/v2/anomalies/process/f0a3a677-b265-4654-af31-1effd5cba063?verbose=false

Error Handling Tips

The 400 error code means that the request was unable to be fulfilled due to invalid data in the request body.

Sample Error Messages

• 400: The anomalyId parameter should be a valid UUID.
• 404: The anomalyId which has been passed in was not found in the database.

Overview

This method enables you to view the Notification Configuration in your organization.

Sample Queries

View the Notification Configuration in your organization:

https://api.threatstack.com/v2/integrations/notification

Overview

This method enables you to update an existing Notification Configuration for threatML in your organization.

Sample Queries

Update an existing Notification Configuration in your organization:

https://api.threatstack.com/v2/integrations/notification

Error Handling Tips

400:

• The url parameter should be valid.
• The uniqueID parameter should be a valid UUID.

404: Could not find Notification Configuration that matched the uniqueID parameter value.

Overview

This method enables you to add a new Notification Configuration for ThreatML to your organization. Distributed Cloud AIP supports a single ThreatML Notification Configuration per organization.

Sample Queries

Add a new Notification Configuration to your organization:

https://api.threatstack.com/v2/integrations/notification

Error Handling Tips

400: The url parameter should contain a valid domain value. The only supported value is “threatML”."

Overview

This method enables you to delete an existing Notification Configuration for threatML in your organization.

Sample Queries

Delete an existing Notification Configuration in your organization:

https://api.threatstack.com/v2/integrations/notification

Error Handling Tips

400: The uniqueID parameter should be a valid UUID. 404: Could not find Notification Configuration that matched the uniqueID parameter value.