Events API for Cyber Resilience
About Cyber Resilience Events API
Using the Events API, you can export events from Cyber Resilience (Accelerated Ransomware Recovery and Security Posture and Observability). This API capability helps organizations to:
- Get all the Ransomware and Security Posture events in a single API call
- Monitor the reported failures and take corrective actions
- Integrate the exported events with the third-party SIEM tool
Workflow to export Cyber Resilience events
- Generate a token to access Event API. For more information, see Use EVENTAPI to export events from Cyber Resilience.
- Access Event API through any REST Client to receive a response in JSON format.
Access Events API
Make API requests. For more information, see the Events API reference
About Events API Response
- Each Ransomware Recovery Events API response contains a maximum of 100 Cyber Resilience events
- If there are more than 100 events in the Cyber Resilience database while returning an Events API response, the response contains the nextPageToken attribute. Use the token provided within the nextPageToken attribute as a query parameter for the Token field to get an additional set of Cyber Resilience events.
- Events API response is in the UTC timezone.
Supported Cyber Resilience events
The following table lists the Cyber Resilience events that you can export by using the Events API:
Malicious File Scan (RWC) and Curated Snapshot (CS) events
Event Category | Event Types | Event State | Description | Event Details |
|---|---|---|---|---|
Admin event | Addition of SHA | Success | Event related to addition of SHA hash(s). | {"Added": 1, "Total": 1, "Invalid": 0, "Skipped": 0, "Duplicate": 0, "Successful": true} |
Admin event | Deletion of SHA | Success | Event related to addition of SHA hash(s). | {"Note": "Deletion note", "SHADetails": "{User Name} deleted the file hash with SHA value {hashvalue} Delete Reason: {Reason} Status: Successful", "Successful": true} |
Admin event | Modification of Scan Settings Scan Settings Updated | Success | Event for modification of scan settings. Updated settings are present in the response. | {"Successful": true, "AVScanEnabled": false, "FileHashScanEnabled": true, "SkipScanForDeviceReplace": true, "AllowAdminToSkipScanServers": true, "AllowUserToSkipScanEndpoints": true, "AllowAdminToSkipScanEndpoints": true} |
Admin event | RWC Job Creation | Success | Event for creation of RWC job. | {"JobType": "Malicious File Scan", "Activity": "Job Created", "ScanJobID": , "StartTime": "", "JobCreatedBy": "InternalAdmin", "ProductJobID": , "ResourceName": "", "ResourceType": "", "ResourceParent": ""} |
Admin event | RWC Job Cancellation | Success | Event for cancellation of RWC job. | {"EndTime": "", "JobType": "Malicious File Scan", "Activity": "Job Cancelled", "ScanJobID": ,"StartTime": "", "FilesBlocked": 0, "FilesScanned": 0, "JobCreatedBy": "InternalAdmin", "ProductJobID": , "ResourceName": "", "ResourceType": "VMware", "JobCancelledBy": "", "ResourceParent": "", "FilesScanSkipped": 0, "FilesSelectedForRestore": 0} |
Admin event | RWC Job Finished | Success | Event for completion of RWC job. | {"EndTime": "", "JobType": "Malicious File Scan", "Activity": "Job Completed", "ScanJobID": , "StartTime": "", "FilesBlocked": 8, "FilesScanned": 110791, "JobCreatedBy": "InternalAdmin", "ProductJobID": , "ResourceName": "", "ResourceType": "","ResourceParent": "", "FilesScanSkipped": , "FilesSelectedForRestore": } |
Admin event | RWC Malicious Files Found | Success | Event for when affected files count is > 0 for RWC job. | {"EndTime": "", "JobType": "Malicious File Scan", "Activity": "Job Completed", "ScanJobID": , "StartTime": "", "FilesBlocked": 8, "FilesScanned": 110791, "JobCreatedBy": "InternalAdmin", "ProductJobID": , "ResourceName": "", "ResourceType": "", "ResourceParent": "", "FilesScanSkipped": , "FilesSelectedForRestore": |
Admin event | CS Job Creation | Success | Event for creation of Curated Snapshot (CS) job. | {"JobType": "Curated Snapshot", "Activity": "Curated snapshot creation started", "ScanJobID": , "StartTime": "","JobCreatedBy": "", "ResourceName": "", "ResourceType": "Endpoint", "ResourceParent": ""} |
Admin event | CS Created | Success | Event for successful completion of creation of Curated Snapshot (CS). | {'area': 'Security', 'category': 'Admin Event', 'type': 'Curated Snapshot', 'syslogSeverity': , 'syslogFacility': , 'SSJobID': , 'Activity': 'Curated snapshot created', 'FilesBlocked': 0, 'ResourceName': "", 'ResourceType': '', 'FilesExcluded': 0, 'FilesIncluded': 0, 'ResourceParent': '', 'FilesScanSkipped': 0} |
Admin event | CS Deleted | Success | Event for deletion of created Curated Snapshot (CS). | {"Activity": "Curated snapshot Deleted", "StartTime": "", "SnapshotID": "", "DeleteReason": "", "ResourceName": "", "ResourceType": "File Server", "ResourceParent": "", "SnapshotDeletedBy": ""} |
Admin event | CS Job Cancelled | Success | Event for cancellation of Curated Snapshot (CS) creation job. | {"JobType": "Curated Snapshot", "Activity": "Curated snapshot creation cancelled", "ScanJobID": , "StartTime": "", "JobCreatedBy": "", "ResourceName": "", "ResourceType": "File Server", "JobCancelledBy": "", "ResourceParent": ""} |
Quarantine Snapshots events
Event Category | Event Types | Event State | Description | Event Details |
|---|---|---|---|---|
Ransomware Recovery | Quarantine Event - Create | Success | Event for creation of Quarantine Range. | {"mode": "Admin Portal", "note": "", "orgID": , "state": "Success", "action": "Create Range", "ipAddress": "", "resourceID": , "initiatorID": "", "rangeEndTime": "", "resourceName": "", "resourceType": "VMware", "rangeStartTime": "", "resourceParent": "", "resourcePlatform": "NA"} |
Ransomware Recovery | Quarantine Event - Update | Success | Event for updating the Quarantine Range. | {"mode": "Admin Portal", "note": "", "orgID": , "state": "Success", "action": "Update Range", "ipAddress": "", "resourceID": , "initiatorID": "", "rangeEndTime": "", "resourceName": "", "resourceType": "VMware", "rangeStartTime": "", "resourceParent": "", "resourcePlatform": ""} |
Ransomware Recovery | Quarantine Event - Delete | Success | Event for deleting a Quarantine Range | {"mode": "Admin Portal", "note": "", "orgID": , "state": "Success", "action": "Delete Range", "ipAddress": "", "resourceID": , "initiatorID": "", "rangeEndTime": "", "resourceName": "", "resourceType": "VMware", "rangeStartTime": "", "resourceParent": "", "resourcePlatform": "NA"} |
Ransomware Recovery | Admin Audit Trail - | Snapshot deleted | Event for deletion snapshot from Quarantine Bay | {"mode": "Admin Portal", "note": "", "orgID": 0, "state": "Success", "action": "", "ipAddress": "", "resourceID": 0, "initiatorID": "", "rangeEndTime": "", "resourceName": "", "resourceType": "", "rangeStartTime": "", "resourceParent": "", "resourcePlatform": ""} |
Security Dashboard events
Event Category | Event Types | Event State | Description | Event Details |
|---|---|---|---|---|
Admin event | Admin Login | Success | Event related to Admin Login attempt. | {"location": "", "adminName": "", "adminEmail": "", "loginResult": "Success", "adminActivity": "Admin Login Event", "adminIPAddress": "", "adminLoginTime": ""} |
Data Access | Data Access | Success | Event for Data Access. | {"size": 0, "files": 0, "status": "Successful", "endTime": "", "targetIP": "", "startTime": "", "resourceID": , "resourceName": "", "initiatorName": "", "targetLocation": ""} |
Admin Event | Admin Login (New location and a different IP address. Alert is generated) | Success | Event for Admin Login (Only when admin has not logged in from the IP in the last 30 days). | {"location": "", "adminName": "", "adminEmail": "", "loginResult": "Success", "adminActivity": "Admin Login Event", "adminIPAddress": "", "adminLoginTime": ""} |
Data Access | Data Access (New location and a different IP address. Alert is generated) | Success | Event for Data Access (Only when data is not accessed from the IP in the last 30 days). | {"size": 0, "files": 0, "status": "Successful", "endTime": "", "targetIP": "", "startTime": "", "resourceID": , "resourceName": "", "initiatorName": "", "targetLocation": ""} |
Unusual Data Activity events
Event Category | Event Types | Event State | Description | Event Details |
|---|---|---|---|---|
Unusual Data Activity | Admin Audit Trail | Success | Event related to UDA logs downloaded by the admin. | {"udaType": ["Modification"], "fileInfo": {"newFiles": 0, "deletedFiles": 0, "updatedFiles": 220, "encryptedFiles": 0}, "adminName": "", "alertTime": "", "resourceID": , "resourceName": "", "resourceType": "File Server", "adminActivity": "Unusual Data Activity - Download logs", "affectedSnapshot": "", "resourceParentID": , "resourceParentName": ""} |
Unusual Data Activity | Alert | Creation | Event related to UDA alert generated because of an anomaly detected in either Creation, Deletion, Modification, or Encryption activity. | {"udaType": ["Modification"], "fileInfo": {"newFiles": 0, "deletedFiles": 0, "updatedFiles": 220, "encryptedFiles": 0}, "alertName": "Unusual Data Activity", "alertTime": "", "resourceID": , "resourceName": "", "resourceType": "File Server", "affectedSnapshot": "", "resourceParentID": , "resourceParentName": ""} |
Unusual Data Activity | Admin Audit Trail | Success | Event for when an alert is marked as ignored. | {"udaType": ["Modification"], "fileInfo": {"newFiles": 0, "deletedFiles": 0, "updatedFiles": 220, "encryptedFiles": 0}, "adminName": "", "alertTime": "", "resourceID": , "resourceName": "", "resourceType": "File Server", "adminActivity": "Unusual Data Activity - Ignore Alert", "affectedSnapshot": "", "resourceParentID": , "resourceParentName": ""} |
Unusual Data Activity | System Event | Warning Event | Warning event when UDA scan fails for VMware resources. | { "id": 185966, |
Unusual Data Activity | System Event | Information Event | Provides information about UDA scan events for VMware resources. | { "id": 186711, |
Updated 2 days ago